[Search for users] [Overall Top Noters] [List of all Conferences] [Download this site]

Conference azur::mcc

Title:DECmcc user notes file. Does not replace IPMT.
Notice:Use IPMT for problems. Newsletter location in note 6187
Moderator:TAEC::BEROUD
Created:Mon Aug 21 1989
Last Modified:Wed Jun 04 1997
Last Successful Update:Fri Jun 06 1997
Number of topics:6497
Total number of notes:27359

477.0. "Register with Access Control....rejected? " by DWOVAX::64544::LICAUSE (Al Licause (338-5661)) Thu Nov 15 1990 09:04

I'm a bit confused on the use of access control an whether or not it is
register properly.

I'm running X1.1.0 and have attempted to register several nodes in the
following manner:

	REGISTER NODE4 FOUR62_NS:.DNA_NODE.BENGAY SYNONYM=BENGAY,
            BY USER=LICAUSE, BY PASSWORD=pass_word

MCC registers this successfully, but when I attempt to show any thing
about this node either in the Windows interface or using the following
command:

	SHOW NODE4 BENGAY ALL IDENT ( or ALL anything)

the command fails with "access control rejected".  I am only successful
if I include specific access control with each command, and don't know
how to do this in the Windows interface.

Am I using incorrect syntax to register the node and access information
or is this access information never passed in subsequent command strings?

If this access control is not used, does this not represent a serious
security risk (passwords typed in plain text), or are we assumed to be
using proxy access?

Any help greatly appreciated.

Al
T.RTitleUserPersonal
Name
DateLines
477.1Access info only on per command basis.NAC::SCHLENERThu Nov 15 1990 14:0116
    As far as the NODE4 commands are concerned, we didn't get any access
    information from DNS. We would only check the incoming command for
    By User and By Password. This may have changed since I left the DECnet
    Phase IV AM group in June. 
    
    Is this By User/By Password a new functionality of the Register
    command? It's possible that the PM's (window interface, console
    interface) are supposed to go into DNS to look for that information.
    I don't know. 
    
    You may want to send mail to Jim Carey (TOOK) to determine if this is
    functionality (the ability to store user/password information in DNS) 
    that is supposed to be supported.
    
    					Cindy
    
477.2Try the command SET NCL DEFAULT ACCESS BY USER=Joe, PASSWORD=xxxCAPN::SYLORArchitect = Buzzword GeneratorThu Nov 15 1990 17:0910
Thou shalt never ever ever store user names and passwords for accessing a 
system in DNS.

The above command sets defaults in NCL, when MCC finishes the syntax changes
in the TRM to conform to NCL, it ought to implement this command as well.

For the windowing PM, there should be some equivalent operation. Don't know what
it is though.

Mark
477.3how to from Iconic MapTOOK::HAOFri Nov 16 1990 08:4717
    I don't know if the Registration FM does anything with the access
    control information sent down with the Register command.
    
    However, to use access control at the Iconic Map PM, look under the
    Operations menu.  There will be a menu item called Operations
    Qualifiers, one of which will be Access Control.  If this is done 
    at the Map Window, then all subsequent Management Windows generated
    from the Map Window will automatically pick up the access control info.
    If this is done at a Managment Window, then the access control info
    only applies to the operation currently being done in the window.
    
    I don't remember if the above was available with the IFT V1.1 version.
    If it wasn't, it's definitely there for the EFT V1.1 version, available
    sometime in late November.
    
    Christine
    
477.4It does but it doesn't.....DWOVAX::64544::LICAUSEAl Licause (338-5661)Mon Nov 26 1990 14:4520
RE:.3

I did look in the OPERATIONS selection and the choice is there.  I did enter
a userid and password.....(the password is echoed.....not good!)

What I observed was that you could now use this information to query a node
with the SHOW option, but could not do same by double-clicking on the
chosen icon.  

This would lead me to believe that there are two different mechanisms for
doing basically the same thing?  Is this so and if so, why is this access
information not passed in one, while it is in the other?

I've also noticed that this access information is only used globally and
not specific to a particular entity.  Are there plans to have multiple
access information stored so that repeated interactive access would not
require  repeated access info updates?

thanks,
Al
477.5use default qualGOSTE::CALLANDERMon Nov 26 1990 15:1529
    Maybe this will help.
    
    The access control information is not stored, to pass it down you
    must explicitly (or implicitly) pass it down on each command. To
    do this explicitly simply put the BY clause on each command, to
    do this implicitly you have two options. Use the "use default
    qualifiers" command to set up a default BY clause (or combination
    of clauses) to be passed down on all commands (unless explicitly
    superceded on the command line) or define a symbol that you can
    use on the command line to quickly insert the by clause without
    typing it out.
    
    ex:
    
    MCC> use default qualif by user = foo, by pass=bar
    MCC> show bridge foo all ident
    
    		translates too >> 
         show bridge foo all ident, by user = foo, by pass=bar
    
    MCC> show bridge foobar all ident, by user=bar, pass=poo
    
    		doesn't translate since the BY clause is explicitly
     		stated and therefore overrides the default.
    
    hope this helps.
    
    jill
    
477.6Yes, but why the difference?DWOVAX::64544::LICAUSEAl Licause (338-5661)Tue Nov 27 1990 08:1411
RE:.5

Thanks for the explaination......I understand that the access info is not
stored, but I'm just curious about the apparent difference in the mechanisms
used when using the SHOW command from the Window interface and double clicking
on a choosen icon.  

I see that the default info is passed using the SHOW command, but why is this
same information not used when you double click?

Al
477.7I will look into it....BARREL::LEMMONTue Nov 27 1990 08:367
re -1

I see your point and will check into this further.   This also applies to
the Add and Delete operations.    At this time I don't pass the qualifiers for
the double click, Add, and Delete operations.  

/Jim