@@ -907,6 +907,29 @@ configure such a Directory Service in addition to the Federations they
907907maintain themselves, as one more source of the union described in
908908[Federations and Directories](#federations-and-directories).
909909
910+ An OCM Server Administrator MAY likewise pre-populate a Federation
911+ configuration with a list of servers assembled out of band, without
912+ using any Directory Service at all. This is the same case already
913+ covered by bullet 2 of [Adding a Member](#adding-a-member): the
914+ curation of the membership is a one-time act of the Administrator
915+ rather than a continuous one delegated to a third-party operator, but
916+ in both this case and the third-party Directory Service case above,
917+ the resulting members were not learned incrementally through the
918+ convergence mechanism of [Peer-announced
919+ Directory](#peer-announced-directory).
920+
921+ For this reason, upon startup an OCM Server MUST send an
922+ ` OCM_SERVER_ADDED` Notification, for the relevant Federation, to every
923+ member it learned of through a third-party Directory Service or an
924+ out-of-band pre-populated list, the first time each such member
925+ appears in its configuration; it MUST NOT send it again for a member
926+ that is already known, so that restarting the OCM Server does not
927+ generate duplicate notifications. This lets those members become
928+ aware of the sending OCM Server and apply the processing described in
929+ [Processing an Addition](#processing-an-addition), so that a
930+ Federation entered through either of these two backward-compatible
931+ routes still joins the peer-announced convergence.
932+
910933# OCM API Discovery
911934
912935# # Introduction
@@ -2572,11 +2595,14 @@ know and have out of band connections with other users on an OCM server.
25722595Further more the [Directory Service](#directory-service) feature can be
25732596used to establish a trusted federation. In the third-party model, a
25742597central authority can be trusted to implement measures for auditing and
2575- adding only trusted servers into the directory. In the peer-announced
2576- model, there is no such central authority : trust is delegated to the
2577- OCM Server Administrators, each of whom agrees to every addition to
2578- their own Federation configuration. This has a number of consequences
2579- that Administrators need to be aware of :
2598+ adding only trusted servers into the directory; an Administrator who
2599+ instead pre-populates a Federation configuration out of band, as
2600+ described in [Third-party Directory
2601+ Service](#third-party-directory-service), plays that same role locally.
2602+ In the peer-announced model, there is no such central authority : trust
2603+ is delegated to the OCM Server Administrators, each of whom agrees to
2604+ every addition to their own Federation configuration. This has a
2605+ number of consequences that Administrators need to be aware of :
25802606
25812607* A member of a Federation can cause any other member to be presented
25822608 with a new peer, by adding that peer and letting the propagation
@@ -2586,6 +2612,15 @@ that Administrators need to be aware of:
25862612 and an Administrator that does not recognise a proposed peer is
25872613 expected to refuse it. Implementations MUST NOT apply such a
25882614 notification automatically.
2615+ * The `OCM_SERVER_ADDED` Notifications an OCM Server sends on startup
2616+ for members obtained from a third-party Directory Service or an
2617+ out-of-band pre-populated list (see [Third-party Directory
2618+ Service](#third-party-directory-service)) reach servers with which
2619+ no prior peer-announced exchange took place. A recipient has no way
2620+ to distinguish such a notification from one resulting from the
2621+ incremental convergence of [Peer-announced
2622+ Directory](#peer-announced-directory): its own Administrator's
2623+ agreement remains the only safeguard, as noted above.
25892624* Membership is only eventually consistent. In particular, a removal
25902625 only ever states that the sender's own directory no longer contains
25912626 the recipient, and cannot be enforced on the other members : a server
0 commit comments