rfc2820.txt

来自「RFC 的详细文档！」· 文本 代码 · 共 508 行 · 第 1/2 页

Network Working Group                                      E. Stokes
Request for Comments: 2820                                  D. Byrne
Category: Informational                                          IBM
                                                          B. Blakley
                                                              Dascom
                                                           P. Behera
                                                            Netscape
                                                            May 2000


                  Access Control Requirements for LDAP

Status of this Memo

   This memo provides information for the Internet community.  It does
   not specify an Internet standard of any kind.  Distribution of this
   memo is unlimited.

Copyright Notice

   Copyright (C) The Internet Society (2000).  All Rights Reserved.

Abstract

   This document describes the fundamental requirements of an access
   control list (ACL) model for the Lightweight Directory Application
   Protocol (LDAP) directory service.  It is intended to be a gathering
   place for access control requirements needed to provide authorized
   access to and interoperability between directories.

   The keywords "MUST", "SHOULD", and "MAY" used in this document are to
   be interpreted as described in [bradner97].

1.  Introduction

   The ability to securely access (replicate and distribute) directory
   information throughout the network is necessary for successful
   deployment.  LDAP's acceptance as an access protocol for directory
   information is driving the need to provide an access control model
   definition for LDAP directory content among servers within an
   enterprise and the Internet.  Currently LDAP does not define an
   access control model, but is needed to ensure consistent secure
   access across heterogeneous LDAP implementations.  The requirements
   for access control are critical to the successful deployment and
   acceptance of LDAP in the market place.

   The RFC 2119 terminology is used in this document.




Stokes, et al.               Informational                      [Page 1]

RFC 2820          Access Control Requirements for LDAP          May 2000


2.  Objectives

   The major objective is to provide a simple, but secure, highly
   efficient access control model for LDAP while also providing the
   appropriate flexibility to meet the needs of both the Internet and
   enterprise environments and policies.

   This generally leads to several general requirements that are
   discussed below.

3.  Requirements

   This section is divided into several areas of requirements: general,
   semantics/policy, usability, and nested groups (an unresolved issue).
   The requirements are not in any priority order.  Examples and
   explanatory text is provided where deemed necessary.  Usability is
   perhaps the one set of requirements that is generally overlooked, but
   must be addressed to provide a secure system. Usability is a security
   issue, not just a nice design goal and requirement. If it is
   impossible to set and manage a policy for a secure situation that a
   human can understand, then what was set up will probably be non-
   secure. We all need to think of usability as a functional security
   requirement.

3.1  General

   G1.  Model SHOULD be general enough to support extensibility to add
   desirable features in the future.

   G2.  When in doubt, safer is better, especially when establishing
   defaults.

   G3.  ACL administration SHOULD be part of the LDAP protocol.  Access
   control information MUST be an LDAP attribute.

   G4.  Object reuse protection SHOULD be provided and MUST NOT inhibit
   implementation of object reuse. The directory SHOULD support policy
   controlling the re-creation of deleted DNs, particularly in cases
   where they are re-created for the purpose of assigning them to a
   subject other than the owner of the deleted DN.

3.2  Semantics / Policy

   S1.  Omitted as redundant; see U8.

   S2.  More specific policies must override less specific ones (e.g.
   individual user entry in ACL SHOULD take precedence over group entry)
   for the evaluation of an ACL.



Stokes, et al.               Informational                      [Page 2]

RFC 2820          Access Control Requirements for LDAP          May 2000


   S3.  Multiple policies of equal specificity SHOULD be combined in
   some easily-understood way (e.g. union or intersection).  This is
   best understood by example.  Suppose user A belongs to 3 groups and
   those 3 groups are listed on the ACL. Also suppose that the
   permissions for each of those groups are not identical. Each group is
   of equal specificity (e.g. each group is listed on the ACL) and the
   policy for granting user A access (given the example) SHOULD be
   combined in some easily understood way, such as by intersection or
   union.  For example, an intersection policy here may yield a more
   limited access for user A than a union policy.

   S4.  Newly created directory entries SHOULD be subject to a secure
   default policy.

   S5.  Access policy SHOULD NOT be expressed in terms of attributes
   which the directory administrator or his organization cannot
   administer (e.g. groups whose membership is administered by another
   organization).

   S6.  Access policy SHOULD NOT be expressed in terms of attributes
   which are easily forged (e.g. IP addresses).  There may be valid
   reasons for enabling access based on attributes that are easily
   forged and the behavior/implications of doing that should be
   documented.

   S7.  Humans (including administrators) SHOULD NOT be required to
   manage access policy on the basis of attributes which are not
   "human-readable" (e.g. IP addresses).

   S8.  It MUST be possible to deny a subject the right to invoke a
   directory operation.  The system SHOULD NOT require a specific
   implementation of denial (e.g.  explicit denial, implicit denial).

   S9.  The system MUST be able (semantically) to support either
   default-grant or default-deny semantics (not simultaneously).

   S10.  The system MUST be able to support either union semantics or
   intersection semantics for aggregate subjects (not simultaneously).

   S11.  Absence of policy SHOULD be interpretable as grant or deny.
   Deny takes precedence over grant among entries of equal specificity.

   S12.  ACL policy resolution MUST NOT depend on the order of entries
   in the ACL.

   S13.  Rights management MUST have no side effects.  Granting a
   subject one right to an object MUST NOT implicitly grant the same or
   any other subject a different right to the same object.  Granting a



Stokes, et al.               Informational                      [Page 3]

RFC 2820          Access Control Requirements for LDAP          May 2000


   privilege attribute to one subject MUST NOT implicitly grant the same
   privilege attribute to any other subject.  Granting a privilege
   attribute to one subject MUST NOT implicitly grant a different
   privilege attribute to the same or any other subject.  Definition: An
   ACL's "scope" is defined as the set of directory objects governed by
   the policy it defines; this set of objects is a sub-tree of the
   directory.  Changing the policy asserted by an ACL (by changing one
   or more of its entries) MUST NOT implicitly change the policy
   governed by an ACL in a different scope.

   S14.  It SHOULD be possible to apply a single policy to multiple
   directory entries, even if those entries are in different subtrees.
   Applying a single policy to multiple directory entries SHOULD NOT
   require creation and storage of multiple copies of the policy data.
   The system SHOULD NOT require a specific implementation (e.g. nested
   groups, named ACLs) of support for policy sharing.

3.3  Usability (Manageability)

   U1.  When in doubt, simpler is better, both at the interface and in
   the implementation.

   U2.  Subjects MUST be drawn from the "natural" LDAP namespace; they
   should be DNs.

   U3.  It SHOULD NOT be possible via ACL administration to lock all
   users, including all administrators, out of the directory.

   U4.  Administrators SHOULD NOT be required to evaluate arbitrary
   Boolean predicates in order to create or understand policy.

   U5.  Administrators SHOULD be able to administer access to
   directories and their attributes based on their sensitivity, without
   having to understand the semantics of individual schema elements and
   their attributes (see U9).

   U6.  Management of access to resources in an entire subtree SHOULD
   require only one ACL (at the subtree root).  Note that this makes
   access control based explicitly on attribute types very hard, unless
   you constrain the types of entries in subtrees.  For example, another
   attribute is added to an entry. That attribute may fall outside the
   grouping covered by the ACL and hence require additional
   administration where the desired affect is indeed a different ACL.
   Access control information specified in one administrative area MUST
   NOT have jurisdiction in another area.  You SHOULD NOT be able to
   control access to the aliased entry in the alias.  You SHOULD be able
   to control access to the alias name.




Stokes, et al.               Informational                      [Page 4]

RFC 2820          Access Control Requirements for LDAP          May 2000


   U7.  Override of subtree policy MUST be supported on a per-
   directory-entry basis.

   U8.  Control of access to individual directory entry attributes (not
   just the whole directory entry) MUST be supported.

   U9.  Administrator MUST be able to coarsen access policy granularity
   by grouping attributes with similar access sensitivities.

   U10.  Control of access on a per-user granularity MUST be supported.

   U11.  Administrator MUST be able to aggregate users (for example, by
   assigning them to groups or roles) to simplify administration.

   U12.  It MUST be possible to review "effective access" of any user,
   group, or role to any entry's attributes. This aids the administrator
   in setting the correct policy.

   U13.  A single administrator SHOULD be able to define policy for the
   entire directory tree.  An administrator MUST be able to delegate
   policy administration for specific subtrees to other users.  This
   allows for the partitioning of the entire directory tree for policy
   administration, but still allows a single policy to be defined for
   the entire tree independent of partitioning.  (Partition in this