[Cosmo] Question about privileges & tickets

Brian Moseley bcm at osafoundation.org
Wed Feb 15 17:16:27 PST 2006


On 2/15/06, Lisa Dusseault <lisa at osafoundation.org> wrote:
> I'd say that that should only be allowed to work if the client
> provides the ticket and the URL (of course in the Request URI), and
> if those in fact match up, then the server provides information on
> that particular ticket.  We don't want to open up for abuse of
> finding previously unknown tickets obviously.

for what it's worth, if you provide basic credentials to cosmo, then
the ticketdiscovery property will contain all tickets owned by that
principal. one use case where this might not be the full set is if an
administrator for some reason creates a ticket on a resource in a
user's home directory.

without thinking through the issue in detail, i agree with lisa that
it doesn't make sense to share the existence of other tickets on a
resource with a person who knows only of one ticket.

i could certainly extend the current functionality so that if the
authentication credential is a ticket id, the ticketdiscovery property
returns the details for that ticket only. indeed, i've opened an
enhancement request for this
(<https://bugzilla.osafoundation.org/show_bug.cgi?id=5200>).

> But this might not be a property any more, or at least it might be a
> different property.  The closest similarity is to the "current-user-
> privilege-set" calculated property defined in ACL (RFC3744), which
> returns the privileges of the current user.  If we modeled a solution
> after that we'd have a 'ticket-info' property which, for the ticket
> (s) provided in the Ticket header, returned what they were good for.

what do you mean by "what they were good for"?

anyway, i think that cosmo, behaving as described in bug 5200, does
basically the same thing for ticketdiscovery as acl defines for
current-user-privilege-set, except it only does it for the one ticket
that is verified as the authentication credential.

i suppose we could add to bug 5200 to have one ticketinfo in the
ticketdiscovery for each ticket id provided in the request. i think i
like that better than inventing another ticket property.



More information about the Cosmo mailing list