Subject: RE: [NSIS] authorization

From: Tschofenig Hannes <[email-masked]>
Date: Thu, 10 Jul 2003 10:20:34 +0200

hi john, 

i somehow got lost in this discussion. 

what is the question that should be answered? 

- is it about at which layer signaling message protection should take place?

- is it about authorization?
if so then we have to further differentiate between different messages and
different locations along the end to end path. i also have to agree that
certain authorization decisions make only sense at the nslp (and at a
particular context). 

ciao
hannes

btw, the aaa context could be somewhat misleading here since the aaa
protocol runs between the aaa server and the attendant whereas the nsis part
would be between the client and the attendant.
that's also the reason why the nsis working group does not really deal with
aaa protocols or extensions. an nsis protocol therefore only serves as a
"information provider" for a subsequent aaa interaction (as proposed in the
past already).

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]
> Sent: Thursday, July 10, 2003 5:24 AM
> To: [email-masked]; Tschofenig Hannes
> Cc: [email-masked]
> Subject: RE: [NSIS] authorization 
> 
> 
> Hi Melinda,
> 
> > I think that if you asked me today (which you did), I
> > wouldn't do any authorization at the NTLP layer.  I'm not
> > sure if it's meaningful.  It seems to me that the questions
> > that would be asked are either "may I send you a packet?"
> > and/or "may I send you an NSLP payload?," neither of which,
> > I think, would be or even could be properly answered by
> > NTLP.  It wouldn't be very difficult to convince me to
> > change my mind on this, but right now it seems that it's the
> > wrong question for NTLP.
> 
> That makes sense, for example, for AAA services, the transport
> protocol is not authorized; it is the AAA protocol (RADIUS,
> Diameter) where the authorization takes place.
> 
> John
> 

_______________________________________________
nsis mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nsis