Subject: [Netconf] Access Control Issues/Question

From: Bert Wijnen <[email-masked]>
Date: Fri, 01 Apr 2011 10:49:34 +0200

WG participants,

Pls comment on this open issues that Martin presented
in his suggested new/improved approach for NACM rule
definitions at our meeting yesterday. The slides
are here:
    http://tools.ietf.org/agenda/80/slides/netconf-1.pdf

- Is two levels of nesting enough?
- A common (?) use case is to define one rulelist for
   a task, and let some groups access it read-write,
   and some read-only. This is not directly supported
   – you would need to define two different rule-lists,
     e.g. routing- admin and routing-read.
   By moving the allowedgroups check from the rule to the
   rulelist, we loose some flexibility. If we really need
   special handling of a rule for some group, this rule
   needs to be defined in a separate rule-list.
- Would it be useful with any objects to help debug a
   NACM configuration?
   - rpc get-rules group-name ---> list of rules
   - rpc check-path group-name path ---> rule execution trace

Bert and Mehmet