Subject: isAccessAllowed in agentx?

From: Randy Presuhn <[email-masked]>
Date: Fri, 29 Dec 2000 10:31:05 -0800 (PST)

Hi -

In an offline discussion, I wrote:

> It annoys me that the disman MIBs require mechanisms
> not provided by agentx to do their job securely.
> I'd be interested in a "companion" protocol providing
> access to the "isAccessAllowed" abstract service.
> This protocol would only have connection setup,
> teardown, and isAccessAllowed query/response.

Bert Wijnen replied:

| Mmmm... we wanted to keep access control and such in the
| master agent. So.... ???
| We do not pass any security related info (like securityName, 
| securityLevel, securityModel etc) to the subagent, so subagent
| cannot pass it back. So the check should be made based on
| an active session, transaction or packet ID or a combination
| of those???

Indeed, this was deliberate, and I still think it was the
right thing to do.   Then along came objects like RFC 2574's
authOwnKeyChange and privOwnKeyChange.  These were tolerable,
since they were still squarely inside the master agent.

My thinking with the disman mibs was that credentials for use
by scripts or expressions would be writeable attributes of
those objects, allowing a manager to delegate authority to
a trusted entity which would work on its behalf.  This would
not require any access decision functions to be invoked
within the disman MIB implementation.

However, what we ended up with was much more like the RMON
approach, with the credentials passed "under the table",
and a need for the disman MIB implementations to be able
to invoke the isAccessAllowed() abstract service interface.

It would be really nice to be able to do this in an
interoperable way.

 -------------------------------------------------------
 Randy Presuhn           [email-masked]
 Voice: +1 408 546-1006  BMC Software, Inc.  1-3141
 Fax:   +1 408 965-0359  2141 North First Street
 http://www.bmc.com/     San José, California 95131  USA
 -------------------------------------------------------
 My opinions and BMC's are independent variables.
 -------------------------------------------------------