Re: [regext] Benjamin Kaduk's Discuss on draft-ietf-regext-org-ext-09: (with DISCUSS and COMMENT)

["Linlin Zhou" <[e-mail]>]

Dear Benjamin,
I've included my feedbacks inline and removed the clarified items.

Regards,
Linlin


Linlin Zhou

> ----------------------------------------------------------------------
> DISCUSS:
> ----------------------------------------------------------------------
 
> Second, I am unsure of the semantics relating to role types, especially as
> they interact with the <update> command.  Various aspects of the examples
> seem to imply that it is only permitted to have at most one organization
> mapping of a given role type (i.e., one reseller, one proxy, etc.).  In
> particular, the <orgext:chg> element seems to be using the <orgext:id> role
> attribute to determine which <orgext:id> is being changed (with the new
> value being provided in the element body), and the <orgext:rem> element is
> providing <orgext:id> with only the role attribute and no body to identify
> a specific organization to remove.  If this reading of the document is
> correct, then I would expect the limitation to be called out more clearly,
> especially as it would seem to prevent a domain owner from (e.g.) using
> multiple DNS service operators.
> [Linlin] In the normal business model, for example a domain should have one reseller, one registrar etc.  How about adding some text like "One <orgext:id> element is suggested for each role type." in the element description.
 
I don't think that addresses my core concern (though it is probably worth
doing in its own right).
 
In particular, if it is allowed by the protocol/registry to have more than
one <orgext:id> element of a given role type, then several of the protocol
exchanges this document defines within <update> are not fully defined in an
interoperable fashion.  For example, what if I receive a
<orgext:chg><orgext:id role="dns-operator>dns872</orgext:id></orgext:chg>
and there are currently two dns-operators defined?  Do I remove both
existing entries and add the one new one?  Do I remove just one existing
entry and replace it with the new one?  If the latter, how do I pick which
one is to be removed?  I just don't see how the operation is fully
specified for these cases.
 [Linlin] We have discussed the error cases, but may lack of this situation.
If there are already multiple IDs exist with a particular role, I suggest not changing the object and returning an error code 2305 which means "Object association prohibits operation".
Maybe some words like "An attempt to change an organization ID with a particular role value, when multiple IDs exist with the same role value, does not change the object at all. A server SHOULD notify clients that object relationships need to be checked by sending a 2305 error response code. "