Subject: Re: [OPSAWG] New Version Notification for draft-zheng-opsawg-tacacs-yang-02.txt

From: "Wubo (lana)" <[email-masked]>
Date: Tue, 2 Jul 2019 10:09:01 +0000

Dear chairs,

The authors believe the TACACS+ YANG draft is ready to be adopted as the wg document.
https://tools.ietf.org/html/draft-zheng-opsawg-tacacs-yang-02

The draft has been presented several times in past working group meetings, and the model structure and specific definitions have been revised with the help of the working group.

We believe this individual draft is mature enough to be a WG work item.

Thanks,
Bo on behalf of all the co-authors

-----邮件原件-----
发件人: OPSAWG [mailto:[email-masked]] 代表 Wubo (lana)
发送时间: 2019年6月20日 21:05
收件人: wangzitao <[email-masked]>; Zhengguangying (Walker) <[email-masked]>; wangzitao <[email-masked]>
抄送: [email-masked]
主题: Re: [OPSAWG] New Version Notification for draft-zheng-opsawg-tacacs-yang-02.txt

Dear WG,

We update the 02 version of draft-zheng-opsawg-tacacs-yang-02 to address the comments from 104 meeting.
https://tools.ietf.org/html/draft-zheng-opsawg-tacacs-yang-02

Here are some major changes in this version:
-  This draft is focused on TACACS+ Client only YANG.
-  Change the module name to ietf-system-tacacsplus.
-  Group the all the rw objects together by changing timeout to server specific.
-  Change "network-instance" to "vrf-instance" to make it specific and add text to describe it.
-  Add "source-interface" as a choice to accommodate one more implementation.

Please help to review the document, comments and suggestions are welcome!

Thanks, 
Bo

-----邮件原件-----
发件人: [email-masked] [mailto:[email-masked]] 
发送时间: 2019年6月20日 20:38
收件人: wangzitao <[email-masked]>; Wubo (lana) <[email-masked]>; Zhengguangying (Walker) <[email-masked]>; Wubo (lana) <[email-masked]>; wangzitao <[email-masked]>
主题: New Version Notification for draft-zheng-opsawg-tacacs-yang-02.txt

A new version of I-D, draft-zheng-opsawg-tacacs-yang-02.txt
has been successfully submitted by Bo Wu and posted to the IETF repository.

Name:		draft-zheng-opsawg-tacacs-yang
Revision:	02
Title:		Yang data model for TACACS+
Document date:	2019-06-20
Group:		Individual Submission
Pages:		14
URL:            https://www.ietf.org/internet-drafts/draft-zheng-opsawg-tacacs-yang-02.txt
Status:         https://datatracker.ietf.org/doc/draft-zheng-opsawg-tacacs-yang/
Htmlized:       https://tools.ietf.org/html/draft-zheng-opsawg-tacacs-yang-02
Htmlized:       https://datatracker.ietf.org/doc/html/draft-zheng-opsawg-tacacs-yang
Diff:           https://www.ietf.org/rfcdiff?url2=draft-zheng-opsawg-tacacs-yang-02

Abstract:
   This document defines a YANG modules that augment the System data
   model defined in the RFC 7317 with TACACS+ client model.  The data
   model of Terminal Access Controller Access Control System Plus
   (TACACS+) client allows the configuration of TACACS+ servers for
   centralized Authentication, Authorization and Accounting.

   The YANG modules in this document conforms to the Network Management
   Datastore Architecture (NMDA) defined in RFC 8342.

Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat

_______________________________________________
OPSAWG mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/opsawg

---

From: Ebben Aries <[email-masked]>
Date: Wed, 10 Jul 2019 16:25:26 +0000

A few quick observations on the model

- The model defines the client configuration and state parameters only
  but to be functional for operator use w/ AAA needs a few other things,
  otherwise this by itself is incomplete
- There should likely be an identity of 'tacacsplus' that is base off
  ietf-system:authentication-method
- The 'user-authentication-order' must restrictions in ietf-system would
  need to be accounted for as is done for radius
- Is there intention to add an equivalent 'tacacsplus-authentication'
  feature much like there is for radius?

Thx

/ebben

---

From: "Wubo (lana)" <[email-masked]>
Date: Thu, 11 Jul 2019 06:59:08 +0000

Hi Ebben,

Thank you for your important comments.
I will add this question to the open issue for discussion and ask our AD for further guidance.
Please see the specific response inline.

Thanks,
Bo

-----邮件原件-----
发件人: Ebben Aries [mailto:[email-masked]] 
发送时间: 2019年7月11日 0:25
收件人: Wubo (lana) <[email-masked]>
抄送: wangzitao <[email-masked]>; Zhengguangying (Walker) <[email-masked]>; [email-masked]
主题: Re: [OPSAWG] New Version Notification for draft-zheng-opsawg-tacacs-yang-02.txt

- The model defines the client configuration and state parameters only
  but to be functional for operator use w/ AAA needs a few other things,
  otherwise this by itself is incomplete
[Bo] Thanks again for your suggestion. You asked this question to us at the 103 meeting, and we submitted version 01 to solve this problem.
https://tools.ietf.org/html/draft-zheng-opsawg-tacacs-yang-01#section-4

Although the augmentation was proposed, the Opsawg WG believes that only the tacacsplus YANG is in scope, system-aaa augmentation is not.
In addition, there are also comments from Radius that system-aaa augmentation cannot solve only tacacsplus. 
So for this augmentation part model, I don't know what to do.

- There should likely be an identity of 'tacacsplus' that is base off
  ietf-system:authentication-method
[Bo] Yes. In the draft, we added:
identity tacacs {
     base sys:authentication-method;

We should define:
identity tacacsplus {
     base sys:authentication-method;

- The 'user-authentication-order' must restrictions in ietf-system would
  need to be accounted for as is done for radius
[Bo] Agree, ‘must’ statement should be added for tacacsplus feature.

- Is there intention to add an equivalent 'tacacsplus-authentication'
  feature much like there is for radius?
[Bo] Yes, but for the time being, we have not yet proposed the augmentation draft.  Or can we can added it as an appendix?
Thx

/ebben