Re: [Netconf] FW: David Harrington's Discuss on draft-ietf-netconf-access-control-06: (with DISCUSS and COMMENT)

Hi,

Juergen Schoenwaelder <j.schoenwaelder@jacobs-university.de> wrote:
> (a) at a course grained level whether dynamically learned groups are
>     used at all (global on/off switch)

This was what dbh suggested, and we believe this is a good idea.  So
we propose we add this.

Furthermore, Andy suggested that the entire concept of "allow
dynamically learned groups" should be a YANG feature.  I.e., optional
to implement.

> (b) at the level of a given transport whether we trust all of the
>     transport's provided dynamic group mappings (this is what DBH
>     suggested I think)

This is what I personally think makes most sense; since it depends on
the transport if you trust it to do the right thing or not.

In any case, this is outside the scope of NACM.

> (c) at the fine grained level of specific user entries whether we
>     accept dynamically learned group entries

Hmm.  I was thinking it might be useful to do this on a group basis.
I.e. maybe you don't want the "superuser" group to be added
dynamically.

/martin

> It might be operationally relevant to allow a configuration that
> generally rejects dynamic group mappings (for a given transport)
> except for a white list of users where we trust the transport to do
> the right thing.
> 
> /js
> 
> -- 
> Juergen Schoenwaelder           Jacobs University Bremen gGmbH
> Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
> Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>
> _______________________________________________
> Netconf mailing list
> Netconf@ietf.org
> https://www.ietf.org/mailman/listinfo/netconf
> 