Re: [GNAP] Enterprise servers and Internet servers use cases

[Fabien Imbault <[e-mail]>]

Hi Denis,

If I understand correctly, your use case is about supporting ABAC, which is
nice and should be fairly easy to do. I think you could make the use case
much simpler, however.

The description is currently very misleading. You're using the term
"capability" is a sense that is very different from the context in which it
is used by everyone else (i.e. ocaps litterature). I actually don't really
understand why you want to use that term here. RBAC vs ABAC pros and cons
are already well known (see for instance
https://www.dnsstuff.com/rbac-vs-abac-access-control), and you don't really
need to introduce capabilities into the mix.

Fabien

On Tue, Aug 18, 2020 at 12:22 PM Denis <[e-mail]> wrote:

> Hello,
>
> I have posted a new use case (unfortunately as usual for me in the wrong
> directory) under the name:
> * Enterprise servers and Internet servers use cases*.
>
> It is available from:
> https://github.com/ietf-wg-gnap/general/wiki/Enterprise-servers-and-Internet-servers-use-cases
>
> At the end of this paper, I have summarized the terminology used in this
> paper.
>
>    - User : human person
>    - individual client : application that requests access tokens on
>    behalf of a User
>    - User Agent : User Interface associated with an individual client
>    that manages the User Consent and choices
>    - enterprise client: application that requests access tokens on behalf
>    of the application
>    - attribute: characteristic of a User or of an Application
>    - capability: pair of elements granted by an AS that indicates which
>    method is allowed on which data object
>    - Attribute-based Access Control (ABAC): access control scheme based
>    on a policy that uses one or more attributes to grant or to deny an
>    operation
>    - User access token: access token that contains attributes related to
>    the User or /and capabilities granted to the User
>    - application access token: access token that contains attributes
>    related to the application or /and capabilities granted to an enterprise
>    client application
>
> Denis
>
> PS. If some one could post a message explaining how to place a use case in
> the right directory, it might be useful for a next time.  :-)
>
>
>
>
> --
> TXAuth mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/txauth
>