Subject: Re: TLS and TN

From: John Hind <[email-masked]>
Date: Sun, 7 Dec 1997 14:26:52 -0500

Deric Villanueva raises an important point :

>Will a TN3270 Server ever be interested in authorization of
>access to setsof discrete resources under it's control?  If
>so, then mutual authentication is necessary to determine client
>authorization level.

*** It is my belief that this will become important and that
mutual authentication should be allowed if not encouraged but
many customers may find one-way good enough for some time
to come so it should not be mandated.

>I can certainly see that if the TN3270 server is attached
>to only 1 host or PU then access control or authorization
>policy might not apply. In this case utilizing the existing
>constucts in 3270 make sense.  However in the case of multiple
>hosts, host types or distributed data links (e.g. SNA
>Server) it might be useful to control access to host resource
>(destination, LU range, printing...) based on user credentials.

*** actually the basic resource level is a pool of LUs and in
addition to what host applications are available to the pool
consideration must be given to availability of to groups of
users.

>Is is safe to do this based on one way authentication of the server?
>Is >this a function that the server vendors even care about?

*** Its "safe" if the 3270 hosts authenticate the users via logon BUT it means
that
the TN server can't help in enforcing resource utilization policies. We know
that
this is important to customers since that's one of the reasons TN3270E added
the ability to specify LUNAME (often used as an LU pool name by TN servers).

John Hind
[email-masked]@internet

---

From: Michael Boe <[email-masked]>
Date: Mon, 08 Dec 1997 12:11:03 -0600

John,

Thanks for the comments....am incorporating your remarks:

> to come so it should not be mandated.

Good...that'll show up in the next draft.

> consideration must be given to availability of to groups of

To clarify:  the basic resource level might as finely grained as having
to choose from a set of LUs which are reserved for that user identity.
Or it could be large-grained distinctions such as whether or not the
user may access certain applications or hosts.

> the ability to specify LUNAME (often used as an LU pool name by TN servers).

Hence, it might be very helpful in certain environments to do
LOGIN-based authentication via a Telnet-level exchange to the TN server
and not the 3270 host.  That way, the TN Server can check authorization
before the TN client gets connected to a particular
application/LU/host.

Put another way: I think LOGON-style authentication may well be a useful
thing in helping the TN server to do authorization/resource-utilizations
policies. I certainly agree with John that such an exchange must come
early in the TN3270E connection lifetime--certainly before the CONNECT
IS/REQUEST message exchange.

/msb