Subject: RE: [NSIS] authorization

From: Tschofenig Hannes <[email-masked]>
Date: Thu, 10 Jul 2003 10:33:14 +0200

hi john, 

that adds some light to our discussion. 

> Hi Hannes,
> 
> What I think we need to discuss & decide upon are the following:
> 
> 1) Security & robustness to DoS attacks at both the NTLP & 
> NSLP layers.
> 2) Authentication & Authorization issues for services.  

that's goes along with my observation. 
 
> My gut feeling is that the AA issues would be most 
> appropriate to handle
> at the NSLP layer.

some of the question we raised with NSIS AAA
(draft-tschofenig-nsis-aaa-issues-01.txt) and with QoS NSLP Authorization
Issues (draft-tschofenig-nsis-qos-authz-issues-00.txt) address this issue.
it is certainly necessary to get some conclusion since it has an impact on
the nslp protocol design. for the nat/firewall handling other authorization
decisions are important as described in  draft-brunner-nsis-midcom-ps-00.txt

small note: authorization does not necessarily need to be combined with
authentication (and also not necessarily at the same layer).
 
> Does this make sense?
yes. 

ciao
hannes

> John
> 
> > -----Original Message-----
> > From: ext Tschofenig Hannes [mailto:[email-masked]]
> > Sent: 10 July, 2003 11:21
> > To: Loughney John (NRC/Helsinki); [email-masked]
> > Cc: [email-masked]
> > Subject: RE: [NSIS] authorization 
> > 
> > 
> > hi john, 
> > 
> > i somehow got lost in this discussion. 
> > 
> > what is the question that should be answered? 
> > 
> > - is it about at which layer signaling message protection 
> > should take place?
> > 
> > 
> > - is it about authorization?
> > if so then we have to further differentiate between 
> different messages and
> > different locations along the end to end path. i also have 
> to agree that
> > certain authorization decisions make only sense at the nslp 
> (and at a
> > particular context). 
> > 
> > ciao
> > hannes
> > 
> > btw, the aaa context could be somewhat misleading here since the aaa
> > protocol runs between the aaa server and the attendant 
> whereas the nsis part
> > would be between the client and the attendant.
> > that's also the reason why the nsis working group does not 
> really deal with
> > aaa protocols or extensions. an nsis protocol therefore 
> only serves as a
> > "information provider" for a subsequent aaa interaction (as 
> proposed in the
> > past already).
> > 
> > > -----Original Message-----
> > > From: [email-masked] [mailto:[email-masked]]
> > > Sent: Thursday, July 10, 2003 5:24 AM
> > > To: [email-masked]; Tschofenig Hannes
> > > Cc: [email-masked]
> > > Subject: RE: [NSIS] authorization 
> > > 
> > > 
> > > Hi Melinda,
> > > 
> > > > I think that if you asked me today (which you did), I
> > > > wouldn't do any authorization at the NTLP layer.  I'm not
> > > > sure if it's meaningful.  It seems to me that the questions
> > > > that would be asked are either "may I send you a packet?"
> > > > and/or "may I send you an NSLP payload?," neither of which,
> > > > I think, would be or even could be properly answered by
> > > > NTLP.  It wouldn't be very difficult to convince me to
> > > > change my mind on this, but right now it seems that it's the
> > > > wrong question for NTLP.
> > > 
> > > That makes sense, for example, for AAA services, the transport
> > > protocol is not authorized; it is the AAA protocol (RADIUS,
> > > Diameter) where the authorization takes place.
> > > 
> > > John
> > > 
> > 
> 

_______________________________________________
nsis mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nsis