Subject: [Netconf] YACM? (RE: WG Adoption Call for draft-bierman-netconf-rfc6536bis WAS:FW: new NACM draft)

From: Alexander Clemm <[email-masked]>
Date: Tue, 31 Jan 2017 22:54:45 +0000

Hi Andy, and Working Group,

Looking at the 6536bis draft, one comment I have is that we should consider to deemphasize the specific protocols used to access the YANG-defined data.  Rather, I think the Access Control Model should be defined in terms of the data that is being accessed, and the operations that clients are authorized to carry out against that data.  In addition, there may be implications to be discussed from the revised datastores draft.  Really, this should be about defining an Access Control Model for operations carried out against a YANG datastore, independent of the specific protocol used for those operations.

I believe one of the intentions behind the draft is to make it less Netconf-dependent, but just extending it to Restconf may not be enough – there may be other transports/mechanisms that could be used to access YANG-defined data and datastores and NACM should apply there as well.  It is fine to explain how NACM will be applied in the particular instances of Restconf and Netconf, but still point out that access method independence.

For example, the abstract states:
There is a need
   for standard mechanisms to restrict NETCONF or RESTCONF protocol
   access for particular users to a pre-configured subset of all
   available NETCONF or RESTCONF protocol operations and content.  This
   document defines such an access control model.

I think this might be better rephrased something like
   There is a need
   for standard mechanisms to restrict access for particular users to a pre-configured subset of all
   available content in YANG datastores and available operations, accessed via mechanisms that include
  YANG NETCONF or RESTCONF protocol operations.  This
   document defines such an access control model.

Perhaps NACM should really be renamed to YACM;-)  I know, the draft is in the Netconf WG, not Netmod, so why should it not be specific to Netconf and Restconf, but still…

Cheers
--- Alex

From: Netconf [mailto:[email-masked]] On Behalf Of Andy Bierman
Sent: Thursday, January 05, 2017 10:27 AM
To: Mehmet Ersue <[email-masked]>
Cc: Netconf <[email-masked]>
Subject: Re: [Netconf] WG Adoption Call for draft-bierman-netconf-rfc6536bis WAS:FW: new NACM draft

On Wed, Jan 4, 2017 at 8:30 AM, Mehmet Ersue <[email-masked]<mailto:[email-masked]>> wrote:
Dear All,

we assume now the WG support for the adoption of
draft-bierman-netconf-rfc6536bis.
Authors please submit as draft-ietf-netconf-rfc6536bis-00. Thanks.

done

Mehmet & Mahesh

Andy

-----Original Message-----
From: Netconf [mailto:[email-masked]<mailto:[email-masked]>] On Behalf Of Mehmet Ersue
Sent: Wednesday, December 14, 2016 10:20 PM
To: 'Netconf' <[email-masked]<mailto:[email-masked]>>
Subject: [Netconf] WG Adoption Call for draft-bierman-netconf-rfc6536bis
WAS:FW: new NACM draft

Dear NETCONF WG,

for the potential topics to add we only got comments from Martin. We assume
now there are no other comments.

This is a 2+ week WG adoption call for draft-bierman-netconf-rfc6536bis to
adopt as NETCONF WG item.

Please state your opinion on the mail list by December 30, 2016 with
"yes/support" or "no support".

If you support, please let us know what you would like to address
additionally.
If you don't support, please elaborate your reasons.

Thank you,
Mehmet & Mahesh

-----Original Message-----
From: Martin Bjorklund [mailto:[email-masked]<mailto:[email-masked]>]
Sent: Wednesday, December 7, 2016 9:20 AM
To: [email-masked]<mailto:[email-masked]>
Cc: [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>
Subject: Re: [Netconf] new NACM draft

MehmetErsue <[email-masked]<mailto:[email-masked]> <mailto:[email-masked]<mailto:[email-masked]>> > wrote:
> Hi Andy, Martin,
>
> thank you for the initial draft.
>
> We discussed in IETF 97 different issues and the additional sections
> we could add.

Ok.  But do we have to resolve all issues before adopting this document?  I
think the current document is ready for adoption, and then the WG can work
on fixing any open issues.

> IIRC the list was:
> - schema-mount related text into schema-mount or the NACM draft,

I think schema mount needs to discuss how it works with NACM.  This should
be an open issue in schema mount.

> - assigning priorities to clients,

I don't believe this is a NACM issue.

> - access control on dynamic datastores (e.g. I2RS),

The text in 3.2 probably need to be relaxed a bit to allow NACM to be
applied to other datastores.

> - the issue from RFC 6536 with parent/child relationships which is
> important for RESTCONF.

Can you elaborate on this?

/martin

>
> I would like to suggest to have a discussion on these issues and
> understand whether they should be included.
>
> Mehmet
>
> On Wed, Nov 30, 2016 at 2:10 AM, Andy Bierman <[email-masked]<mailto:[email-masked]>
<mailto:[email-masked]<mailto:[email-masked]>> > wrote:
>
> > Hi,
> >
> > A new version of draft-bierman-netconf-rfc6536bis has been posted:
> > https://www.ietf.org/id/draft-bierman-netconf-rfc6536bis-01.txt
> >
> >
> > We would like this draft to be adopted as the starting point for
> > item #5 in the current NETCONF charter.
> >
> >
> >
> > Andy and Martin
> >
> >
> > _______________________________________________
> > Netconf mailing list
> > [email-masked]<mailto:[email-masked]> <mailto:[email-masked]<mailto:[email-masked]>>
> > https://www.ietf.org/mailman/listinfo/netconf
> >
> >
>
>
> --
> Cheers,
> Mehmet

_______________________________________________
Netconf mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/netconf

_______________________________________________
Netconf mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/netconf

---

From: Andy Bierman <[email-masked]>
Date: Tue, 31 Jan 2017 15:57:04 -0800

On Tue, Jan 31, 2017 at 2:54 PM, Alexander Clemm <[email-masked]
> wrote:

> Looking at the 6536bis draft, one comment I have is that we should
> consider to deemphasize the specific protocols used to access the
> YANG-defined data.  Rather, I think the Access Control Model should be
> defined in terms of the data that is being accessed, and the operations
> that clients are authorized to carry out against that data.  In addition,
> there may be implications to be discussed from the revised datastores
> draft.  Really, this should be about defining an Access Control Model for
> operations carried out against a YANG datastore, independent of the
> specific protocol used for those operations.
>
>
>
> I believe one of the intentions behind the draft is to make it less
> Netconf-dependent, but just extending it to Restconf may not be enough –
> there may be other transports/mechanisms that could be used to access
> YANG-defined data and datastores and NACM should apply there as well.  It
> is fine to explain how NACM will be applied in the particular instances of
> Restconf and Netconf, but still point out that access method independence.
>

Good points.
It would be nice to be done with NACM even if we are not done inventing
YANG-based protocols.
There is an inherent conflict between generic operations and
interoperability for a specific protocol.

e.g., we can change <edit-config> to say 'an edit operation' but now it is
no longer clear
what NETCONF requires for each operation.

It might be possible to define NACM using a generic protocol interaction
model,
and then have a separate (short) section that maps each protocol to the
generic model.
We can define codepoints for the CRUD-XN model and assign procedures to the
codepoints.
The draft does that already but there is no generic model, just straight
mappings
to NETCONF and RESTCONF.

> Perhaps NACM should really be renamed to YACM;-)  I know, the draft is in
> the Netconf WG, not Netmod, so why should it not be specific to Netconf and
> Restconf, but still…
>
>
hmm - that might be a better name as we adjust to the fact that
YANG is no longer coupled to NETCONF.

Andy

>
>
> *From:* Netconf [mailto:[email-masked]] *On Behalf Of *Andy
> Bierman
> *Sent:* Thursday, January 05, 2017 10:27 AM
> *To:* Mehmet Ersue <[email-masked]>
> *Cc:* Netconf <[email-masked]>
> *Subject:* Re: [Netconf] WG Adoption Call for draft-bierman-netconf-rfc6536bis
> WAS:FW: new NACM draft
>
>
>
>
>
>
>
> On Wed, Jan 4, 2017 at 8:30 AM, Mehmet Ersue <[email-masked]> wrote:
>
> Dear All,
>
> From: Netconf [mailto:[email-masked]] On Behalf Of Mehmet Ersue
> To: 'Netconf' <[email-masked]>
> From: Martin Bjorklund [mailto:[email-masked]]
> To: [email-masked]
> Cc: [email-masked]; [email-masked]
> MehmetErsue <[email-masked] <mailto:[email-masked]> > wrote:
> > Hi Andy, Martin,
> >
> > On Wed, Nov 30, 2016 at 2:10 AM, Andy Bierman <[email-masked]
> <mailto:[email-masked]> > wrote:
> >
> > > Hi,
> > >
> > > [email-masked] <mailto:[email-masked]>
> [email-masked]
> [email-masked]