Re: [MEXT] Review of draft-ietf-mext-binding-revocation-03.txt

[Sri Gundavelli <sgundave at cisco.com>]

Hi Yungui,

The authorization check is for a specific case of bulk revoc
operation. A single dereg message and a bulk revocation
messages, have different impact scope and so are the
authorization checks which need to define finer access
controls matching the specific impact scope.

Sri


On Tue, 17 Mar 2009, Yungui Wang wrote:

> Hello
>
> Sorry for jumping in.
> A MAG deletes 30,000 bindings continuously (via 30,000 messages),
> whose impact is the same as deleting 30,000 bindings via 1 message.
> I can't find its difference too. That's, 'impact many sessions' seems not
> very convinced.
> In my mind, if a MAG is not allowed to delete binding, it can't delete
> any binding, vice versa.
>
> > MAG created a single binding and can very well delete a single binding
> > by sending a single request. That did not provide an explicit right
> > to delete all 30,000 bindings in a single message. That request needs
> > to pass additional authorization, as that can impact many sessions.
>
> B.R.
> Yungui