Re: [Ace] Context-based Authorization

["Kumar, Sandeep" <[e-mail]>]

> -----Original Message-----
> From: Ace [mailto:[e-mail]] On Behalf Of Ludwig Seitz
>
> On 07/15/2014 05:19 AM, Likepeng wrote:
> > Hi all,
> >
> > Personally I am wondering whether or not we should support
> > context-based authorization indicated in
> > http://tools.ietf.org/html/draft-seitz-ace-usecases-01.
> >
> > For U2.4, do we want to achieve something like this: if time is 9:00 ~
> > 18:00, Client A is allowed to turn on a light, but Client B is not allowed?
>
> Yes that's one example.
>
> >
> > To me, this is purely Resource Server side policy setting and
> > enforcement. Does it require any information exchange with
> > Authorization Server? Is it necessary?
>
> We are moving away from requirements here and getting into solutions, but
> for the sake of clarification: I don't think this kind of policy should be on the
> RS, it should be maintained and managed by the AS, for the same reasons we
> want all the other authorization policies to be on the AS. The solution I have
> in mind are conditional authorization decisions in the style: "You are
> permitted to turn on the light, provided it is between 9:00 and 18:00".
>

[SK] Completely agree with Ludwig. Context-based policies are very relevant in IoT if they need invisibly mesh with our daily lives.
How to implement it is something we need to discuss during the solution phase. However to me this does not sound like only a
RS side policy setting, since RS still needs to figure out if it was A or B who is allowed within that context. Enforcement could be RS side depending on the ability of RS to verify context.

regards
Sandeep

________________________________
The information contained in this message may be confidential and legally protected under applicable law. The message is intended solely for the addressee(s). If you are not the intended recipient, you are hereby notified that any use, forwarding, dissemination, or reproduction of this message is strictly prohibited and may be unlawful. If you are not the intended recipient, please contact the sender by return e-mail and destroy all copies of the original message.