Subject: [seamoby] Authentication vs Authorization

From: [email-masked]
Date: Mon, 11 Jun 2001 08:39:37 +0300

Hi all,

I started to read the thread having to do with Authentication
vs Authorization, but gave up - I get enough of playing with
mud when I play with my 4 year old ... so for give me if I
missed a pearl of wisdom in the mails I skipped.

What I wonder is, if the issue of authentication vs authorization
has more to do with:

	when you are authenticated, 
	when you are authorized, 
	who authenticates you, 
	who authorizes you

I'd suggest that you the two do not always need to go together. 
For example, if one is authenticated when attaching to the 
network, it might not be necessary to re-authenticate the
user at each handover - especially if one is moving within
an AD.  One might want to re-authenticate a user when moving
across AD boundaries.  Of course, this is assume that the 
underlying protocols are secured, so that we can rely on the
fact that once someone is authenticated, we can assume that
we 'know' the user.

best regards,
John

---

From: Michael Thomas <[email-masked]>
Date: Mon, 11 Jun 2001 08:16:28 -0700 (PDT)

> fact that once someone is authenticated, we can assume that

John,

This is somewhat dependent on how you define
"authenticate".  If part of your definition is
that you run a keyed hash over a message using a
shared secret, then I believe that you must always
authenticate to the newAR. Effectively, the
messagewise authentication lies in a different
realm as the original authentication (eg, using
AAA), but messages still need authentication.

For CT, I believe that the requirement is that we
be able to cut out any long round trips which may
be involved with, say, AAA so that the
reauthentication can be performed locally where
possible. This clearly is going to come into
conflict across AD's as you mention, but it is
important to note that within the AD you still
need to authenticate (and re-authorize) each time
you attach to the new AR.

	Mike