Attributes

Each NSA will base its authorization on the attributes of the user that signed the request. Requests between NSA�s will be signed by the sending NSA but will also include an global identity attribute for the request originator which could be used for authorization or logging. The primary attributes that will be used for authorization are those of the requesting NSA.

An attribute will consist of a name, which may designate a class of attributes, and one or more values. It is also allowed for a user to have more than one attribute with the same name and different values. The intent is for each user to have only one role, but it is possible to have more than one. All the authorizations granted by the attributes will be combined in way to maximize the access.

Supported attributes

name	value	data type
globalUserName	�person�@�institution�	xsd:string
institutionName	user�s home institution	xsd:string
role	AuthorizedUser	xsd:string
role	NetworkEngineer	xsd:string
role	SiteAdministrator	xsd:string
role	NetworkOperator	xsd:string
role	NSA	xsd:string
privilege	SpecifySTPList	xsd:string
project	project user belongs to	xsd:string

Authorization

While each NSA will do its own authorization, if there is no common agreement on attributes and what authorizations they enable, it will be hard for inter-domain operations to succeed. Thus for a NSA to support this profile the following authorizations for each attribute should be supported. The various roles are designed to match the privileges that a given class of users require. Privilege and project attributes can be combined with roles to grant finer grained access.

Supported authorizations

attribute	resource	permission	constraint
AuthorizedUser	reservation	create, provision, release, cancel, query	only for own reservations
NetworkEngineer	reservation	create	may specify ordered STPList
NetworkEngineer	reservation	provision, release, cancel, query	all reservations
SiteAdministrator	reservation	create, provision, release, cancel, query	reservations starting or ending with a segment in local domain
NetworkOperator	reservation	query	all reservations in local domain
NSA	reservation	create,	may specify globalReservationId may specify ordered STPList
NSA	reservation	provision, release, cancel, query	all reservations
SpecifySTPList	reservation	create	may specify ordered STPList