Subject: [mile] ROLIE Authorization and Authentication

From: "Banghart, Stephen A. (Fed)" <[email-masked]>
Date: Fri, 29 Jul 2016 17:52:11 +0000

Hello all,

Following the discussion at IETF 96 on draft-ietf-mile-rolie-03, there are some issues that we wanted to bring to the mailing list for discussion. This e-mail references GitHub issue #34 (https://github.com/CISecurity/ROLIE/issues/34). The text from the issue is duplicated here for convenience:

Authentication and authorization can be handled using a number of different mechanisms, for this reason it's not clear if we can require a specific mechanism in the ROLIE core. More discussion is needed with the working group to determine a way forward.

Proposals:

- A: Select one or more authentication and authorization mechanisms as mandatory to implement (MTI).
- B: Address these issues in separate drafts.

Support for OAUTH, http-auth, and XACML has been discussed in a limited capacity previously. Given that deployed solutions may require different authentication and authorization solutions based on differing deployment requirements, we are concerned about requiring any single solution. Furthermore, defining requirements for multiple solutions will add significant page count to the draft. As a result, we are leaning towards proposal B which would allow for some modularity in solutions through additional drafts.

Are there any concerns with going this route?

If option A is desired, we could use some help from someone knowledgeable in using authentication and authorization solutions with HTTP RESTful services.

Thanks,
Stephen Banghart

---

From: Adam Montville <[email-masked]>
Date: Sun, 31 Jul 2016 10:51:56 -0500

Hi Stephen,

If the primary purpose of ROLIE is to make public information available, then leaving the authentication piece to separate drafts (your Option B) seems to make sense.  My interest in ROLIE is centered on the ability to syndicate configuration checklists, which is a class of security automation information generally available to the public.

I suspect that information sharing organizations may have a different perspective.

I cannot authoritatively speak to which mechanism(s) would be best, but it seems to be the case that OAUTH is widely used for many REST APIs in the wild.  I have not seen XACML used in such a context.  I'm also not sure that we should get into authorization.

Kind regards,

Adam

> On Jul 29, 2016, at 12:52 PM, Banghart, Stephen A. (Fed) <[email-masked]> wrote:
> 
> Hello all,
> 
> Following the discussion at IETF 96 on draft-ietf-mile-rolie-03, there are some issues that we wanted to bring to the mailing list for discussion. This e-mail references GitHub issue #34 (https://github.com/CISecurity/ROLIE/issues/34 <https://github.com/CISecurity/ROLIE/issues/34>). The text from the issue is duplicated here for convenience:
> 
> Authentication and authorization can be handled using a number of different mechanisms, for this reason it’s not clear if we can require a specific mechanism in the ROLIE core. More discussion is needed with the working group to determine a way forward.
> 
> Proposals:
> 
> _______________________________________________
> mile mailing list
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/mile <https://www.ietf.org/mailman/listinfo/mile>