-
Key: DDSSEC11-108
-
Status: closed
-
Source: Real-Time Innovations ( Dr. Gerardo Pardo-Castellote, Ph.D.)
-
Summary:
In 8.8.6 AccessControl behavior with remote participant discovery, we state:
If the ParticipantSecurityAttributes object returned by the AccessControl operation
get_participant_sec_attributes has the is_access_protected attribute set to
FALSE, the DomainParticipant may discover DomainParticipants that cannot be authenticated
because they either lack support for the authentication protocol or they fail the authentication protocol.
These “Unauthenticated” DomainParticipant entities shall be matched and considered
“Unauthenticated” DomainParticipant entities.Also in 8.8.7.1 AccessControl behavior with discovered endpoints from “Unauthenticated” DomainParticipant:
Note that, as specified in 8.8.2.2, a DomainParticipant for whom the
ParticipantSecurityAttributes object returned by the AccessControl operation
get_participant_sec_attributes has the is_access_protected attribute set to
TRUE, cannot be matched with an “Unauthenticated” DomainParticipant and therefore cannot
discover any endpoints from an “Unauthenticated” DomainParticipant.This is overlapping with allow_unauthenticated_participants. If allow_unauthenticated_participants, then we should allow for unauthenticated participants independently of is_access_protected. In fact, we will not call to any of the AccessControl (nor any other plugin) APIs for that unauthenticated participant.
For authenticated participants, we should do all the checkings depending on the value for is_access_protected .
-
Reported: DDS-SECURITY 1.0 — Thu, 6 Jul 2017 13:33 GMT
-
Disposition: Duplicate or Merged — DDS-SECURITY 1.1
-
Disposition Summary:
Duplicates
DDSSEC11-14(and its resolution)Duplicates
DDSSEC11-14(resolved asDDSSEC11-126) -
Updated: Tue, 19 Dec 2017 20:03 GMT
DDSSEC11 — Participant's is_access_protected Functionality Overlaps with allow_unauthenticated_participants
- Key: DDSSEC11-108
- OMG Task Force: DDS Security 1.1 RTF