Re: [core] Questions and comments against the github version

[Lauri Piikivi <[e-mail]>]

Hi,

I just want to verify that the endpoint identity, and related access control is part of the question below. If a EP publishes itself in rd, no other ep, based on adequate authenticaiton, can overwrite it. If an earlier registered EP makes a new registration to the RD, where it does not include the location in the path, is an indication that the EP may have reset or otherwise wants a new registration (e.g. Due to changed attributes) in the rd.

Another ep trying to post to another ep’s url should get an error. This requires authenticaiton.

If there is adeqaute authenticaiton, and access control to the publishing, then retrieving all the eps is not a problem.

Sincerely,
- Lauri


Get Outlook for iOS<https://aka.ms/o0ukef>
________________________________
From: core <[e-mail]> on behalf of Peter van der Stok <[e-mail]>
Sent: Wednesday, December 12, 2018 8:21 AM
To: Jim Schaad
Cc: [e-mail]; [e-mail]
Subject: Re: [core] Questions and comments against the github version



Jim Schaad schreef op 2018-12-11 18:41:


From: Peter van der Stok <[e-mail]>
Sent: Tuesday, December 11, 2018 12:59 AM
To: Jim Schaad <[e-mail]>
Cc: [e-mail]; [e-mail]
Subject: Re: Questions and comments against the github version

Hi Jim,

thanks, for the questions.
One explanation for one question.

Jim Schaad schreef op 2018-12-11 03:22:
*  In section 5.3, I don't understand why the rule exists that if the
attribute values are different then the location of the registration needs
to be changed.   It seems that this could lead to some interesting conflicts
in behavior depending on what messages are used.  For example  (content
omitted for clarity):

POST /rd?ep=e1&foo=over

Res: 2.01 Created
Location-Path: /rd/4001

POST /rd?ep=e1&foo=under

Res: 2.01 Created
Location-Path: /rd/4002

As opposed to:

POST /rd?ep=e1&foo=over

Res: 2.01 Created
Location-Path: /rd/4001

POST /rd/4001?foo=under

Res: 2.01 Changed

<pvds>
The feeling was that a first ep having done the earlier registration /rd/4001
should not be able to manipulate the 2nd registration by a 2nd ep, by removing /rd/4001
and having a registration /rd/4002 only known to 2nd ep.
</pvds>

[JLS] The only problem with this is that the query of endpoints needs to be changed so that the endpoint locations are not returned.  Once the query is done then the location is known to a 2nd ep.

<pvds>
Is true.
The above statement is not about security and hiding information.
It is to prevent non-malicious unwanted mistakes.
</pvds>
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.