13 Oct
2005
13 Oct
'05
1:46 p.m.
On Oct 12, 2005, at 13:41, Mike Helm wrote:
We switched from a test, development lab CA (DOE Science Grid) to a production quality CA (doegrids), and we used this property to ease subscribers' transition to the new CA. Lesson? Overlapping name spaces might be useful!
Overlapping namespaces considered harmful -- The two CAs were not of equal "quality" (security and assurance level). The existing mechanisms did not enable a service to authorize subjects from the better CA to a different level than subjects from the inferior CA. (Unless one of those levels was "zero.")