[Wimse] Comments on draft-ietf-wimse-arch-01

["Flemming Andreasen (fandreas)" <[e-mail]>]

Hi

I took a look at the latest architecture draft (draft-ietf-wimse-arch-01) and I have some comments.

Major comments:
===========
1) Definition of Workload
The current definition is "a running instance of software", which I think is overly restrictive. Most definitions I have seen allow for a lot of different form factors ranging from a single process to multiple nodes in different geographies and they also allow for workloads to consist of other workloads. From an identity point of view, I think we want to support all of these variations and in particular recognize that workloads can be made up of other workloads, and we may very well want to allow for separate identifiers for those. For example, consider a geographically redundant 3-tier web app; we may want an authenticated identifier for each process, each database, each app, and each web-server as well as the combination of all of them (the "web app"). We may also want to allow for workloads to assume the identity of another party (per OAuth) - I'm guessing this is what Section 3.2.4 (Delegation and Impersonation) is a placeholder for (?).


2) Workload Identity
I find the whole Identity notion problematic the way it's currently written and I would argue against using that term to begin with. The Identifier part is fine, but when we get into talking about attributes, context, etc. and how they are part of identity it quickly gets both confusing and inconsistent. Section 3.2.3 for example implies that all identity information is authenticated whereas Section 3.1 does not. There was a good thread on this topic ("What is an identity...." https://mailarchive.ietf.org/arch/msg/wimse/lkBh5AS63J8gXxtgHqo5X4RxN6A/) where Justin and Pieter argued for breaking it up into more distinct and better defined concepts. I am very much in favor of that too.



Minor comments:
===========
1) Section 2 - Attestation
As noted in the document, the definition needs to be updated. I would also note that the terms "task" and "separate workload" (as opposed to a "not separate workload" ?) are not well defined.

2) Section 3.1 - Workload Identity
Do we want to support IPv4 and IPv6 addresses as trust domains too, or only domain names ? Note that SPIFFE allows for IPv4 addresses in the Trust Domain (but not IPv6).

3) Section 3.2.6
It's not clear what "communication across trust boundaries" means. If this is referring to "Trust Domains", then we should use that terminology instead for consistency.


I also have some editorial comments/nit fixes, which I'll provide separately.


Cheers

-- Flemming