Re: [Netconf] WG LC for draft-ietf-netconf-rfc6536bis

[Andy Bierman <[e-mail]>]

On Thu, May 4, 2017 at 10:43 PM, Juergen Schoenwaelder <
[e-mail]> wrote:

> On Thu, May 04, 2017 at 01:02:39PM -0700, Andy Bierman wrote:
> > On Thu, May 4, 2017 at 12:14 PM, Juergen Schoenwaelder <
> > [e-mail]> wrote:
> >
> > > On Thu, May 04, 2017 at 11:28:48AM -0700, Andy Bierman wrote:
> > >
> > > > there is no text about candidate vs. running vs. startup.
> > > > The NACM rules apply to all of them the same.
> > > > I could add text that says there is no consideration for specific
> > > > datastores.
> > > > Most rules apply to the schema tree. Data rules apply to instance
> data
> > > > but they apply to all instances in all datastores).  I can make this
> > > clear
> > > > in the next revision
> > >
> > > Does NACM apply to an I2RS datastore? Just checking before a generic
> > > all datastores quantifier is put in place. Perhaps it is safer to say
> > > where we know NACM applies and leave the rest to be defined later.
> > >
> > >
> > It applies to all datastores.
> > The datastore may not support all the CRUD operations that NACM supports.
> > The subset that does apply is enforced.
> >
> > The other variant (the datastore supports more operations than the
> > NACM CRUDX model supports) is not covered.
> >
> > So NACM should be careful to say new operations not covered by CRUDX
> > are out of scope.
> >
> > IMO the  I2RS user priority enforcement is part of the protocol, not
> NACM,
> > similar to NETCONF enforcing data-missing on a delete operation.
> >
>
> Do we allow for the possibility to have datastores that use a
> different access control model, if ever needed?
>

that would certainly be out of scope for this document.
If something else replaces NACM the server would advertise that module
instead of ietf-netconf-acm.



> /js'
>


Andy


>
> --
> Juergen Schoenwaelder           Jacobs University Bremen gGmbH
> Phone: [phone]         Campus Ring 1 | 28759 Bremen | Germany
> Fax:   [phone]         <http://www.jacobs-university.de/>
>