Re: [Atoca] What information is used for authorization?

Hi Art, 

I think it would be useful to have an example here. 

For example, it would be important to know to whom the individual (in our terminology the Author of the Alert message) would authenticate himself to.

Also, it might be useful to know what a gateway, relay or even a Receiver (not to talk about a Recipient) would do with this information. 

Then, with 'credentialling agency' you mean the entity that issued the credentials to the individual (the Author). For example, in a public key based system we are talking about the certificate authority here. Right?

Ciao
Hannes

On Jan 15, 2011, at 11:51 PM, Art Botterell wrote:

> I'd suggest requiring credible identification of the individual and of the credentialling agency.  (Not every gateway will necessarily honor credentials from every issuer.)   Different gateways could then apply different policies based on those and on message contents, including potentially special CAP parameters or other fields as desired locally.
> 
> Thanks!
> 
> - Art
> 
> On Jan 15, 2011, at 11:31 AM, Hannes Tschofenig <hannes.tschofenig@gmx.net> wrote:
> 
>> Hi all, 
>> 
>> it was Igor again who raised a question regarding authorization at the IETF#79 ATOCA meeting. He was wondering whether we would only consider the identity of the originator for authorization or some other information as well.
>> 
>> Are we considering trait-based authorization, see http://www.rfc-editor.org/rfc/rfc4484.txt,  to be utilized in this context? 
>> 
>> So, what model do we envision? 
>> What other information is useful in the context of an authorization decision? 
>> 
>> Ciao
>> Hannes
>> 
>> _______________________________________________
>> earlywarning mailing list
>> earlywarning@ietf.org
>> https://www.ietf.org/mailman/listinfo/earlywarning