Re: [Ace] Offline operation of Resource Server

[Likepeng <[e-mail]>]

Hi Ludwig,

> It means exactly the kind of offline validation that Michael described above.
> 
> 1. You need some initial enrollment of AS <-> RS (that could be online or offline
> & manual such as by reading off some QR code with the RSs initial key material
> and feeding that to the AS).
> 
> 2. Then you need some online authorization decision step between C and AS.
> 
> 3. Then (possibly later) there is some interaction between C and RS, that could
> be offline. Here RS needs to be able to do offline validation of the
> authorization decision from step 2.

This seems to be the normal flow.

If I check the draft section 4.3.4, in the normal flow, the RS also does not need to contact the AS for the online validation of the access token.
http://tools.ietf.org/html/draft-selander-core-access-control-02

Do you mean Client is also offline, and can't contact with AS?

In draft-seitz-ace-problem-description section 4.5, the offline requirement/assumption is:

     o RS may not be able to communicate with AS at the time of the request from C.
  
But I am not clear, only RS can’t communicate with AS, or both Client and RS can’t communicate with AS?

Kind Regards
Kepeng

> -----邮件原件-----
> 发件人: Ace [mailto:[e-mail]] 代表 Ludwig Seitz
> 发送时间: 2014年7月15日 13:48
> 收件人: [e-mail]
> 主题: Re: [Ace] Offline operation of Resource Server
> 
> On 07/14/2014 10:12 PM, Michael Richardson wrote:
> >
> > Hannes Tschofenig <[e-mail]> wrote:
> >      > To re-use the Kerberos language, the client gets the TGT. The
> real-time
> >      > interaction I was talking about relates to the interaction between the
> >      > resource server and the authorization server.
> >
> > During enrollment, the Authorization Server gets a TGT on the *resource*
> server.
> > Given that, it can now issue new tickets to clients that come along
> > that wish to access the resource.  The client, during enrollment, asks
> > the (possibly federated list of) authorization servers for a resource ticket.
> > (This is why part of network join needs to be in scope for ACE)
> >
> > All of the above has to occur online.
> >
> > Once the client has the resource ticket, the resource server can validate it
> offline.
> >
> 
> 
>  >>Ludwig, could you please explain this offline requirement a bit more?
> 
> It means exactly the kind of offline validation that Michael described above.
> 
> 1. You need some initial enrollment of AS <-> RS (that could be online or offline
> & manual such as by reading off some QR code with the RSs initial key material
> and feeding that to the AS).
> 
> 2. Then you need some online authorization decision step between C and AS.
> 
> 3. Then (possibly later) there is some interaction between C and RS, that could
> be offline. Here RS needs to be able to do offline validation of the
> authorization decision from step 2.
> 
> 
> /Ludwig
> 
> --
> Ludwig Seitz, PhD
> SICS Swedish ICT AB
> Ideon Science Park
> Building Beta 2
> Scheelevägen 17
> SE-223 70 Lund
> 
> Phone [phone]
> http://www.sics.se