Subject: RE: Replacing the QAUTH concept (was [Simple] SIMPLE BoF agenda)

From: Ben Campbell <[email-masked]>
Date: Thu, 15 Mar 2001 13:13:33 -0500

>
> > But unless I am missing something, the information you 
> refer me to does not
> > address my scenarios. If we use a rule based (i.e. CPL 
> like) mechanism along
> > with the concept of subscribing to my list of subscribers, 
> then in my first
> > scenario the authorization has already occured before I get 
> notification
> > that my list of subscribers has changed. It doesn't matter 
> if I 202 X or 200
> > X. He will most likely have already received a NOTIFY with 
> my real presence
> > data long before I can get a new rule set pushed into the server.
> 
> This was discussed in the "immediate notify issue" thread, 
> basically the first
> NOTIFY contains the presentity is offline is the subscription 
> is rejected or
> requires authentication, when a new policy is uploaded if 
> only authorised
> subscribers recieve the real presence info, unauthorised 
> subscribers will see
> nothing and can't tell if you really are offline, rejecting 
> them or just not
> issued authorisation yet.
> 

I think you miss the point of my first scenario. It was not concerned with
what happens when a subscriber is not authorized. My concern was with the
model that says "follow the rule, then inform the presentity if you accepted
a new subscription so that they can push new policy to remove the
authorization." This becomes a case of closing the barn door after the horse
has left. I might can keep X from receiving future information about me, but
the server has _already_ given X my current data.

Perhaps we need to think in term of how the mechanism gets used by a real
application. A number of presence services use rule based authorizations,
and a CPL like approach would work fine for them. But what if I want to
build a service that behaves like Yahoo, where the service asked me for
permission _before_ allowing the subscription. (I don't mean before sending
a 202 and/or a dummy notify, but before starting to send NOTIFYs with real
data in them). Can I do that with policy rules and a subscription to the
list of subscribers? If so, how?

---

From: James Undery <[email-masked]>
Date: Fri, 16 Mar 2001 09:09:26 +0000

> the server has _already_ given X my current data.

No X has been told you are offline regardless of your status, until
authorisation is given when X will get the truth!

James Undery