Subject: Re: [MOBILE-IP] AAA with address allocation

From: Vipul Gupta <[email-masked]>
Date: Mon, 6 Dec 1999 09:33:47 -0800

I agree with you that with either certs or Kerberos, their is no
  need to rely on a traditional AAA for the "Authentication" part.
  However, one may still be able to reuse the Authorization and
  Accounting services, e.g. I can see a DHCP relay sending accounting
  information to a AAA server when DHCP lease renewals occur. Then
  again, there's the question of do we need a new protocol for this
  or can the relay use an existing protocol (LDAP?) to update
  the accounting records and to check for authorization status.

  vipul

> Date: Fri, 3 Dec 1999 18:31:50 -0800
> From: Bernard Aboba <[email-masked]>

> > Perhaps the AAA interaction should be
> > tied to the address allocation mechanism, e.g. a DHCP (or a PPP) server ?
>
> It might make sense to use authenticated DHCP (either the public key draft
> or the Kerberos auth draft) in this situation. However, I'd note that
> these DHCP authentication mechanisms aren't linked to AAA because there
> is no need to proxy them. For example, one can evaluate a public key
> authentication merely via knowledge of the cert and evaluation of a
> digitally signed MAC. Similarly, validation of a Kerberos ticket has
> no AAA component to it.

---

From: "[email-masked]" <[email-masked]>
Date: Mon, 6 Dec 1999 10:03:43 -0800

LDAP for Inter-Domain is typically frowned upon. Most networks don't open up
their directories for write access from hosts outside their networks.

PatC