diff --git a/IETF-RFC.md b/IETF-RFC.md index b32688a..da4dddb 100644 --- a/IETF-RFC.md +++ b/IETF-RFC.md @@ -1,6 +1,6 @@ --- title: 'Open Cloud Mesh' -docname: draft-ietf-ocm-open-cloud-mesh-03 +docname: draft-ietf-ocm-open-cloud-mesh-04 category: std ipr: trust200902 diff --git a/IETF-RFC.xml b/IETF-RFC.xml index db1a2f0..fed4b83 100644 --- a/IETF-RFC.xml +++ b/IETF-RFC.xml @@ -12,7 +12,7 @@ ]> - + Open Cloud Mesh @@ -20,7 +20,7 @@ CERN
giuseppe.lopresti@cern.ch - http://cern.ch/lopresti + https://cern.ch/lopresti
@@ -45,7 +45,7 @@ - + Applications and Real-Time @@ -816,11 +816,11 @@ notifications to exchange updates on shares and invites. Page to facilitate the Invite flow. "webdav-uri" - to indicate that this OCM Server can append a relative URI to the path listed for WebDAV [RFC4918] in the -appropriate resourceTypes entry "protocol-object" - to -indicate that this OCM Server can receive a Share Creation -Notification whose protocol object contains one property per -supported protocol instead of containing the standard name and -options properties. +appropriate resourceTypes entry + "protocol-object" - to indicate that this OCM Server can +receive a Share Creation Notification whose protocol object +contains one property per supported protocol instead of containing +the standard name and options properties. OPTIONAL: criteria (array of string) - The criteria for accepting a Share Creation Notification. @@ -971,15 +971,18 @@ servers MAY only support webdav. OPTIONAL accessTypes (array of strings) - The type of access being granted to the remote resource. If omitted, it defaults to -['remote']. A subset of: - remote signals the recipient that -the resource is available for remote access and interactive -browsing. - datatx signals the recipient that the resource is +['remote']. A subset of: + + remote signals the recipient that the resource is available +for remote access and interactive browsing. + datatx signals the recipient that the resource is available for data transfer. If no expiration is given, the share is suitable e.g. for sync use-cases, whereas if an expiration date is set, the above clause MAY apply and the recipient SHOULD notify the sender upon completing the data transfer, in order to ease cache operations on the Sending Server. The recipient MAY delegate a third-party service to execute the data transfer on their behalf. + REQUIRED uri (string) A URI to access the Remote Resource. The URI SHOULD be relative, in which case the prefix @@ -990,21 +993,25 @@ A secret to be used to access the Resource, such as a bearer token. To prevent leaking it in logs it MUST NOT appear in any URI. OPTIONAL permissions (array of strings) - -The permissions granted to the sharee. A subset -of: - read allows read-only access including -download of a copy. - write allows create, update, and delete -rights on the Resource. - share allows re-share rights on the -Resource. +The permissions granted to the sharee. A subset of: + + read allows read-only access including download of a copy. + write allows create, update, and delete rights on the Resource. + share allows re-share rights on the Resource. + OPTIONAL requirements (array of strings) - The requirements that the sharee MUST fulfill to -access the Resource. A subset of: - must-use-mfa requires the -consumer to be MFA-authenticated. This MAY be used if the -recipient provider exposes the enforce-mfa -capability. - must-exchange-token requires the recipient to +access the Resource. A subset of: + + must-use-mfa requires the consumer to be MFA-authenticated. +This MAY be used if the recipient provider exposes the +enforce-mfa capability. + must-exchange-token requires the recipient to exchange the given sharedSecret via a signed HTTPS request to the Sending Server's {tokenEndPoint} [RFC6749]. This MAY be used if the recipient provider exposes the exchange-token capability. + OPTIONAL size (integer) The size of the resource to be transferred, useful especially in case of datatx access type. @@ -1019,10 +1026,12 @@ be relative, in which case the prefix exposed by the /.well-known/ocm endpoint MUST be used. Absolute URIs are deprecated. REQUIRED viewMode (string) -The permissions granted to the sharee. A subset of: - view -allows access to the web app in view-only mode. - read allows -read and download access via the web app. - write allows full -editing rights via the web app. +The permissions granted to the sharee. A subset of: + + view allows access to the web app in view-only mode. + read allows read and download access via the web app. + write allows full editing rights via the web app. + OPTIONAL sharedSecret (string) An optional secret to be used to access the remote web app, for example in the form of a bearer token. @@ -1031,9 +1040,10 @@ web app, for example in the form of a bearer token. OPTIONAL accessTypes (array of strings) - The type of access being granted to the remote resource. If omitted, it defaults to -['remote']. A subset of: - remote signals the recipient that -the resource is available for remote access, e.g. via sshfs. +['remote']. A subset of: + remote signals the recipient that +the resource is available for remote access, e.g. via sshfs. datatx signals the recipient to transfer the resource from the given URI via scp. The recipient MAY delegate a third-party service to execute the data transfer on their behalf. @@ -1418,7 +1428,9 @@ Values" registry (using the template from [RFC9553]). Values indicating how an OCM address was established. -Initial Contents: +Initial Contents: + +
+ |--------------|------------------------------------------| +]]>
@@ -1858,6 +1871,12 @@ implementor might find it useful to have a Provider object model to store the discovered information about federation peers or other remote OCM Providers. +The following diagram is illustrative and non-exhaustive. The single +source of truth for Provider properties is the OCM API Discovery Fields +section; for the box contents below, see the Properties subsection and +the normative capability, criteria, and resource type definitions in +that section. +
| - inviteAcceptDialog | | - provider | | - publicKey | - | - tokenEndpoint | + | - tokenEndPoint | + | - ... | +-----------------------+ | | exposes | +---------+---------+----------------------+ | | | - v v v -+------------------+ +------------------+ +------------------+ -| ResourceTypes[] | | Capabilities[] | | Criteria[] | -+------------------+ +------------------+ +------------------+ -| - name | | - enforce-mfa | | - allowlist | -| - shareTypes[] | | - exchange-token | | - denylist | -| - protocols{} | | - invite-wayf | | - http-signatures| -+------------------+ | - invites | | - invite | - | | - webdav-uri | | - token-exchange | - | +------------------+ +------------------+ + v v | ++------------------+ +------------------+ | +| ResourceTypes[] | | Capabilities[] | | ++------------------+ +------------------+ | +| - name | | - enforce-mfa | | +| - shareTypes[] | | - exchange-token | | +| - protocols{} | | - http-sig | | +| - ... | | - invites | | ++------------------+ | - notifications | | + | | - protocol-object| | + | | - webdav-uri | | + | | - ... | | + | +------------------+ | + | | + | +----------------+ + | | + | v + | +--------------------------+ + | | Criteria[] | + | +--------------------------+ + | | - allowlist | + | | - denylist | + | | - http-request-signatures| + | | - invite | + | | - token-exchange | + | | - ... | + | +--------------------------+ + | | supports v +------------------+ @@ -2087,6 +2125,14 @@ version in the IETF datatracker. It is meant to ease the review process and it shall be removed when going to RFC last call. The complete changelog is updated in the OCM-API GitHub repository. +
Version 04 + + Clarified that the diagrams in Appendix D are illustrative and +not normative. + Minor formatting fixes. + + +
Version 03 Fixed formatting of artworks, code blocks and bullet lists. @@ -2171,571 +2217,576 @@ Tilo Steiger, C.D. Tiwari, Alejandro Unger and Tom Wezepoel.