Subject: [sacm] [draft-ietf-sacm-architecture] Section 3.1.3 - Controller -- Authentication (#25)

From: Jim Schaad <[email-masked]>
Date: Wed, 08 Jul 2015 16:19:38 -0700

version -03

I also have a problem reading the first sentence in this section.  It just does not seem to flow well.

I don't understand what the two bullets are trying to say.   Are we saying that we do not support the use cases where consumers may request information from a specifically identified provider?

It is also not clear to me, but it might become clearer in the future, how authentication is going to be done.  I would assume that for the cases of a consumer not knowing the identity of the provider, it will actually just treat the broker/proxy as if it were the provider.  In this case does the consumer not just authenticate itself to the broker and authenticate the broker for itself?   

It is not clear to me that the control channel and the data channel are always going to be physically separate.  They may be virtually separate but not always.  For example, a consumer could talk to a broker, which set ups a channel and on you go.  On the other hand, the consumer could just send authentication and authorization data directly to a provider which can validate them and accept the request and process it.  This text seems to be overly restrictive in terms of what can be implemented.

---
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-architecture/issues/25