Re: [Atoca] What information is used for authorization?

At a high level, the question of what *information* is used for authorization is not one for this group to consider.  That's a policy question, not an engineering question.  Our focus should be specifying *containers* for such information; at most, we specify what *can* be used for authorization, not what *will* be.

At a technological level, I would suggest that we take this in steps.  

Identity-based access control is clearly low-hanging fruit: There are long-standing mechanisms in several protocols (HTTP, SIP, XMPP, etc.) for authenticating users either with shared secrets or with PKIX certificates.  

PKIX-based authentication in particular can also support some forms of attribute-based authorization, e.g., based on CA identity, CP OID, or extensions like the Clearance attribute [1].  This approach has the benefit that several organizations already have the necessary authentication/authorization infrastructure -- there's not necessarily a need for any new credentials or processes.

Once we have something basic in place based on these technologies, then we can certainly look at ways of adding additional attributes, say using SAML or attribute certificates.

--Richard

[1] <http://tools.ietf.org/html/rfc5913>

On Jan 15, 2011, at 2:31 PM, Hannes Tschofenig wrote:

> Hi all, 
> 
> it was Igor again who raised a question regarding authorization at the IETF#79 ATOCA meeting. He was wondering whether we would only consider the identity of the originator for authorization or some other information as well.
> 
> Are we considering trait-based authorization, see http://www.rfc-editor.org/rfc/rfc4484.txt,  to be utilized in this context? 
> 
> So, what model do we envision? 
> What other information is useful in the context of an authorization decision? 
> 
> Ciao
> Hannes
> 
> _______________________________________________
> earlywarning mailing list
> earlywarning@ietf.org
> https://www.ietf.org/mailman/listinfo/earlywarning