Subject: IPP>SEC -Reply

From: "Scott A. Isaacson" <[email-masked]>
Date: Thu, 27 Feb 1997 10:52:33 -0700

>>> <[email-masked]> 02/25/97 10:18am >>>
    2) Access controlled:  The Printer object has an associated
  Access Control List (ACL). Identification is required, but
  authentication (other than perhaps a password) is not.
| Identification may flow with the IPP request or may be
| included as part of the underlying transport. Data is most
  likely always sent in the clear.  Again this is probably
  most suited for environments where Printers are not
  accessible from outside of an organization*,s firewall.
  However certain printers may be usable only by certain
  groups within an organization. This scheme also allows
  for accounting to be applied to printing based on user
  or group identity.
>>> <[email-masked]> 02/25/97 10:18am >>>

It looks like this clarifies the distinction that the "identity" of the client is
either supplied by the application level protocol OR by the underlying
connection services OR both and that this identity is just a suggestion of
truth, there is no verification (validation).  This identity usually comes
from some authenticated name within the system, but once it crosses
over into the print service, there is probably not more validation being
done, and as Bob suggested, this could (relatively) easily be spoofed.

Scott