Re: [Netconf] WG LC for draft-ietf-netconf-rfc6536bis

[Juergen Schoenwaelder <[e-mail]>]

On Thu, May 04, 2017 at 01:02:39PM -0700, Andy Bierman wrote:
> On Thu, May 4, 2017 at 12:14 PM, Juergen Schoenwaelder <
> [e-mail]> wrote:
> 
> > On Thu, May 04, 2017 at 11:28:48AM -0700, Andy Bierman wrote:
> >
> > > there is no text about candidate vs. running vs. startup.
> > > The NACM rules apply to all of them the same.
> > > I could add text that says there is no consideration for specific
> > > datastores.
> > > Most rules apply to the schema tree. Data rules apply to instance data
> > > but they apply to all instances in all datastores).  I can make this
> > clear
> > > in the next revision
> >
> > Does NACM apply to an I2RS datastore? Just checking before a generic
> > all datastores quantifier is put in place. Perhaps it is safer to say
> > where we know NACM applies and leave the rest to be defined later.
> >
> >
> It applies to all datastores.
> The datastore may not support all the CRUD operations that NACM supports.
> The subset that does apply is enforced.
>
> The other variant (the datastore supports more operations than the
> NACM CRUDX model supports) is not covered.
> 
> So NACM should be careful to say new operations not covered by CRUDX
> are out of scope.
> 
> IMO the  I2RS user priority enforcement is part of the protocol, not NACM,
> similar to NETCONF enforcing data-missing on a delete operation.
> 

Do we allow for the possibility to have datastores that use a
different access control model, if ever needed?

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: [phone]         Campus Ring 1 | 28759 Bremen | Germany
Fax:   [phone]         <http://www.jacobs-university.de/>