Subject: Re: [eap] comments on draft-ietf-eap-netsel-problem-06.txt

From: Bernard Aboba <[email-masked]>
Date: Thu, 10 May 2007 09:24:11 -0700

Joe Salowey said: 
 
"Sorry, the section should be 2.3.   Just because you have a trusted root certificate and can authenticate the identity of a AAA server does not mean that the AAA server should be authorized to be part of the AAA chain.   The same goes for source routing, just because a client specifies a particular path it should be allowed."
 
Section 2.3.3 says: 
 
   Since the AAA   proxies on the roaming relationship path are constrained by existing   relationships, NAI-based source routing is not source routing in the   classic sense; it merely suggests preferences among already   established realm routes.  If a realm route does not exist or is not   feasible, then NAI-based source routing cannot establish it.
 
I suggest changing this to: 
 
"Since the AAA proxies on the roaming relationship path are 
constrained by existing relationships, NAI-based source routing
is not source routing in the classic sense; it merely suggests
preferences which the AAA proxy can choose not to accomodate. 
 
Where realm routes are set up as the result of pre-configuration
and dynamic route establishment is not supported, if a realm route
does not exist, then NAI-based source routing cannot establish it. 
 
Even where dynamic route establishment is possible, such as where
the AAA client and server support certificate-based authentication,
and AAA servers are discoverable (such as via the mechanisms
described in [RFC3588]), a AAA proxy may choose not to establish
a realm route by initiating the discovery process based on a 
suggestion in an NAI-based source route.  
 
Even where the realm route does exist, or the AAA proxy is capable of
establishing it dynamically, the AAA proxy may choose not to 
authorize the client to use it."

_________________________________________________________________
To unsubscribe or modify your subscription options, please visit:
http://lists.frascone.com/mailman/listinfo/eap

Arhives: http://lists.frascone.com/pipermail/eap

---

From: "Joseph Salowey (jsalowey)" <[email-masked]>
Date: Thu, 17 May 2007 13:56:01 -0700

This resolves my comment.

Thanks,

Joe 

> -----Original Message-----
> From: Bernard Aboba [mailto:[email-masked]] 
> Sent: Thursday, May 10, 2007 9:24 AM
> To: [email-masked]
> Subject: Re: [eap] comments on draft-ietf-eap-netsel-problem-06.txt
> 
> Joe Salowey said: 
>  
> "Sorry, the section should be 2.3.   Just because you have a 
> trusted root certificate and can authenticate the identity of 
> a AAA server does not mean that the AAA server should be 
> authorized to be part of the AAA chain.   The same goes for 
> source routing, just because a client specifies a particular 
> path it should be allowed."
>  
> Section 2.3.3 says: 
>  
>    Since the AAA
>    proxies on the roaming relationship path are constrained 
> by existing
>    relationships, NAI-based source routing is not source 
> routing in the
>    classic sense; it merely suggests preferences among already
>    established realm routes.  If a realm route does not exist 
> or is not
>    feasible, then NAI-based source routing cannot establish it.
>  
> constrained by existing relationships, NAI-based source 
> routing is not source routing in the classic sense; it merely 
> suggests preferences which the AAA proxy can choose not to 
> accomodate. 
>  
> Where realm routes are set up as the result of 
> pre-configuration and dynamic route establishment is not 
> supported, if a realm route does not exist, then NAI-based 
> source routing cannot establish it. 
>  
> Even where dynamic route establishment is possible, such as 
> where the AAA client and server support certificate-based 
> authentication, and AAA servers are discoverable (such as via 
> the mechanisms described in [RFC3588]), a AAA proxy may 
> choose not to establish a realm route by initiating the 
> discovery process based on a suggestion in an NAI-based 
> source route.  
>  
> Even where the realm route does exist, or the AAA proxy is 
> capable of establishing it dynamically, the AAA proxy may 
> choose not to authorize the client to use it."
> 
> 
>  
>  
> 
>