Subject: Re: [MOBILE-IP] AAA with address allocation

From: Bernard Aboba <[email-masked]>
Date: Fri, 3 Dec 1999 18:31:50 -0800

> Perhaps the AAA interaction should be
> tied to the address allocation mechanism, e.g. a DHCP (or a PPP) server ?

It might make sense to use authenticated DHCP (either the public key draft
or the Kerberos auth draft) in this situation. However, I'd note that
these DHCP authentication mechanisms aren't linked to AAA because there
is no need to proxy them. For example, one can evaluate a public key
authentication merely via knowledge of the cert and evaluation of a
digitally signed MAC. Similarly, validation of a Kerberos ticket has
no AAA component to it.

---

From: Patrice Calhoun <[email-masked]>
Date: Sat, 4 Dec 1999 08:11:52 -0800

Yes, but as usual, authentication is normally not sufficient. Real-time
authorization is typically required. Authorization certificates could do
it, but they are long lived, and the home server normally expects (today)
to make real-time decisions, which is then used for fraud-detection,
resource usage limitations, matching with accounting records etc.

PatC

---

From: Vipul Gupta <[email-masked]>
Date: Mon, 6 Dec 1999 10:04:05 -0800

If domain A trusts domain B for accessing its authorization information
   and supplying accounting records, I don't see why the protocol
   should matter (unless the protocol is not secure). AFAIK LDAP does
   allow for the client to be authenticated so I'm not sure I see
   a security problem here.

   vipul

> LDAP for Inter-Domain is typically frowned upon. Most networks don't open up
> their directories for write access from hosts outside their networks.
>
> PatC
>
> >   I agree with you that with either certs or Kerberos, their is no
> >   need to rely on a traditional AAA for the "Authentication" part.
> >   However, one may still be able to reuse the Authorization and
> >   Accounting services, e.g. I can see a DHCP relay sending accounting
> >   information to a AAA server when DHCP lease renewals occur. Then
> >   again, there's the question of do we need a new protocol for this
> >   or can the relay use an existing protocol (LDAP?) to update
> >   the accounting records and to check for authorization status.
> >
> >   vipul
> >
> > > Date: Fri, 3 Dec 1999 18:31:50 -0800
> > > From: Bernard Aboba <[email-masked]>
> >