> From rdebry at juno.com Fri Feb 21 11:27:09 1997
>> IPP Security Requirements
> 2) Access controlled: The Printer object has an associated Access
> Control List (ACL). Identification is required, but authentication (other
> than perhaps a password) is not. Data is most likely always sent in the
> clear. Again this is probably most suited for environments where
> Printers are not accessible from outside of an organization's firewall.
> However certain printers may be usable only by certain groups within an
> organization. This scheme also allows for accounting to be applied to
> printing based on user or group identity.
You have included a good selection of security scenarios, but I think
that you have missed one. Your #2 case above may cover this case, but
I'm not sure.
The one you have missed is the most prevalent one in use today, namely
the weak Unix security model where the underlying transport supplies
the user id and the user doesn't have to deal with security explicitly
except during login. The server authenticates using this user id. This
user id is easily spoofed by a knowledgeable user and it doesn't work
across domains, but it is better than nothing and is good enough for
many sites.
If #2 covers this case, it needs some more wordsmithing.
Bob Herriot