Subject: [Mip6] [issue52] Address Authorization in DNS update

From: Gerardo <[email-masked]>
Date: Mon, 03 Oct 2005 15:00:54 +0000

New submission from Gerardo <[email-masked]>:

Jari wrote:
>>Hmm. An address authorization issue appears to come to the picture
>>even in the home agent based solution. We don't want a mobile node
>>M1 to take over the DNS name of mobile node M2. That's why the
>>home agent, or someone, needs to authorize the use of a particular
>>fqdn. This is later correctly noted, but not here.
>>
>>
>>
Gerardo wrote:
>So, if I understand correctly, your point is that, even if the HA
>performs the DNS update, it needs to get in touch with the AAA server
>(or equivalent) to check if the MN is authorized to use that particular
>FQDN. If so, I think it makes sense and I'll provide some text to
>address it.
>
>
Jari wrote:
"
Yes. The check may be an implementation issue, but before you
do the check, you need protocols to transport enough information
around so that you'll actually be able to make the check.
"

and Jari wrote:
>>I'm not sure its just an implementation issue. If its the
>>home agent that
>>performs such an update, then its likely that some AAA attributes
>>are needed to support that (authorized-fqdn,
>>feel-free-to-trust-the-mobile-node-
>>on-its-any-request attributes, for instance). Similarly, if its the
>>AAA server that performs the update, then the fqdn needs to be
>>carried in the protocol.
>>

Gerardo wrote:
>Yes. These attributes are needed in the AAA-HA communication and should
>be listed as goals for AAA-HA interface.
>In this draft we did not address AAA backend issues. Do you think that
>text should be improved somehow? A reference to an update of [12] may
be
>useful, as we have done in section 6, paragraph 5.
>

Jari wrote:
"
It might be prudent to at least point out the requirement
to transport this particular piece of information, and perhaps
even stating that at the time of writing this no such attribute
has been defined for commonly used aaa protocols.
"

James wrote:
"
I agree. We need to mention that the HA must perform an address 
authorization check. Even if the address is a CGA, the HA will have to 
determine that the MN actually owns the FQDN. If there's an AAA server 
involved, it can certainly be contacted as Jari mentions, but if not (i.e. 
PKI) it gets tricky.
"

----------
category: Editorial
draft: draft-ietf-mip6-bootstrapping-split
messages: 173
nosy: gerardo
priority: Should fix
status: Pending
title: Address Authorization in DNS update

_________________________________________________
Mip6 issue tracker <[email-masked]>
<http://www.mip4.org/issues/tracker/mip6/issue52>
_________________________________________________

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6