[core] application group and security group mapping

[Christian Amsüss <[e-mail]>]

Hello CoRE,
hello Jim (whose review on group discovery [1] trigered this),
hello groupcomm-bis authors (whose terminology this will be about),

groupcomm-bis describes that application-groups can be n:m mapped to
security groups.

In one direction, this is rather straight-forward: Different
applications can share a security group provided they use different
paths, as a way to keep management and overhead low.

In the other direction (one application group using multiple security
groups), there's two scenarios this can possibly be used for:

A. Security groups are used equivalently. The servers need to join each
  of the groups, but for a client it is sufficient to join any.
  (Especially, for clients it is sufficient to support any of the
  group's signature algorithm rather than all).

B. Security grroups have different properties within the application
  group. Particular operations may require the client to pick a special
  group.

I think that B is calling for trouble implementation-wise and would be
better addressed by using different application groups. The application
should interact with application group memberships and possibly roles in
that application group, but never handle (or express policy for)
security group identifiers.

Follow-up discusson on the last item of [1] which Marco mentioned
indicates that there is a use case for those -- please tell me about
those!


If there is a case for B, I'd like to hear it (and especiallly
understand why it can't be better solved by administrative grouping of
application groups). The upcoming version of oscore-discovery currently
contains a line on the "client joins any, server joins all" that assumes
A, so if B is supposed to be viable, let's talk about it.

Otherwise (ie. if only A is the intended and the cases for B were
misrepresented), some clarification might help in groupcomm-bis.

Kind regards
Christian

[1]: https://mailarchive.ietf.org/arch/msg/core/h62d2c2mYmG43ykz52KvbbEpgDc/

-- 
Es ist nicht deine Schuld, dass die Welt ist, wie sie ist -- es wär' nur
deine Schuld, wenn sie so bleibt.
(You are not to blame for the state of the world, but you would be if
that state persisted.)
  -- Die Ärzte