Access Controls - MANAGE ACL page: replace or merge

[hafner at almaden.ibm.com]

* From the T10 Reflector (t10 at t10.org), posted by:
* hafner at almaden.ibm.com
*


Folks,

Another issue that was raised at the teleconf on Access Controls dealt with
the MANAGE ACL action and how a given "ACL Entry Page" was handled.
The question was whether a "grant" page (for example) would REPLACE
the existing ACL data for the specified Initiator Identifier (say AccessID)
or
whether it should just imply a change (or merge) of the new data with the
existing data.

The initial feeling at the meeting was that this should be a "replace"
action.
This means that PAM would need to always do something like read/modify
write
(read=REPORT ACL, write=MANAGE ACL) to get the correct ACL data.

I went back and looked at the current wording.   With the exception of the
confusion (noted by Ralph Weber) on the difference between the LUN Map
and the ACL, the current wording is intended to mean "merge".  E.g.
(pdfpage 44):
   "The Grant page ... The target shall modify each affected
   initiator's LUN Map by ADDING (my emphasis) entries for the
   specified LUN/default LUNs...rules of 4.2"
The correct wording for this ought to be something like
   "The Grant page... The access controls coordinator shall
   modify the ACL data for the specified <sc>Initiator
   Identifier</sc> as follows:
     (a) adding the specified LUN association for the logical
     unit referenced by a default LUN value if that logical
     unit is not currently part of that <sc>Initiator
     Identifier</sc>'s ACL data
     b) changing the LUN association for the logical unit,
     in the other case.
Additionally, the access controls coordinator shall modify the
LUN Map for any initiator identified by the specified
<sc>Initiator Identifier</sc> according to the rules of 4.2."

I'm (weakly) proposing that we keep this model and not change to the
"replace"
format.   If PAM needs to do a replace, she can, in the same service
action,
include one Revoke All page followed by a Grant (or Grant All) page with
each
page containing the same <sc>Initiator Identifier</sc>.  In this way, she
can avoid
the  "read".

Note in particular that there is wording that says that each page in the
parameter
data is handled sequentially (see the top of pdfpage 43).

What debate does this question stir up?

Jim Hafner


*
* For T10 Reflector information, send a message with
* 'info t10' (no quotes) in the message body to majordomo at t10.org