Subject: Re: authmeth transition table

From: "Roger Harrison" <[email-masked]>
Date: Wed, 05 Nov 2003 21:48:33 -0700

I've checked most of the authmeth transition table for accuracy, and I
believe it is close to complete. I still have an action item to do a
final review, but I'd appreciate additional eyes looking at it. The idea
to split it into TLS and non-TLS, either via two tables or via two areas
of the same table is one that I'll seriously consider.
 
Roger

>>> Hallvard B Furuseth <[email-masked]> 11/5/2003 5:13:29 AM
>>>
[Sorry if this is a duplicate.]

Have anyone read and checked the authmeth transition table?
Will anyone use it?

Unless it can be converted to graphics, I think it would be better to
replace it with a textual summary of authmeth actions.

Failing that, I agree with whoever suggested to split it into two
tables: TLS actions (start TLS/close) and non-TLS actions (bind). Each
table will be much more readable if they are smaller and contain less
state. (Besides, that might make it easier to convert it to graphics.)

-- 
Hallvard

---

From: Hallvard B Furuseth <[email-masked]>
Date: Thu, 6 Nov 2003 17:32:30 +0100

> of the same table is one that I'll seriously consider.

In that case I suggest you drop AuthZ ID (J) and maybe TLS Creds (I)
from the table.  All you need to mention is whether or not bind
succeeds.  If one uses EXTERNAL with a J which is not allowed by I, it
fails, just like any other bind.  That's covered elsewhere.

If you keep I, it should not be related to TLS - it should just be the
any auth ID from the currently relevant underlying protection mechanism,
or whatever it is called.  I say "currently relevant" in case one is
using both IPSec and TLS, then EXTERNAL has to choose the certificate
from one of them.  Unless StartTLS should then fail if they do not
match.

-- 
Hallvard