partial locking and access control

[Andy Bierman <ietf@andybierman.com>]

Hi,

The requirement about 'must have enough access rights'
to get a partial lock is problematic.

In order to accept this requirement, I have to accept the fact
that NETCONF has a proprietary access control model, instead
of no access control model at all, and I don't.

The standard access control model in NETCONF is that every user has
access to every part of every configuration database.  That means
that any user can partial-lock anything, unless it is already locked.


(BTW, checking partial locks at configure time doesn't work
for nodes that match the Xpath expression at access time,
but did not exist at partial-lock config-time.  The config-time-only
for arbitrary Xpath approach is completely broken for this reason.)


Andy



--
to unsubscribe send a message to netconf-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/netconf/>