Re: [Ace] Offline operation of Resource Server

[Hannes Tschofenig <[e-mail]>]

To re-use the Kerberos language, the client gets the TGT. The real-time
interaction I was talking about relates to the interaction between the
resource server and the authorization server.

Maybe the language in the use case document needs to be a bit more explicit.

Ludwig, could you please explain this offline requirement a bit more?

Ciao
Hannes


On 07/14/2014 08:01 PM, Michael Richardson wrote:
> 
> Hannes Tschofenig <[e-mail]> wrote:
>     > in one of my previous mail I said that the requirements rule out an
>     > EAP/AAA solution and this impression was based on reading the following
>     > requirement from http://tools.ietf.org/html/draft-seitz-ace-usecases-01
> 
>     > "
>     > o  U5.2 The meters must be able to perform fine-grained access
>     > control on the metering data and on the configuration while being
>     > offline.
>     > "
> 
>     > I was wondering how strong the requirement for not having a real-time
>     > interaction between the resource server and the AS is.
> 
> I think it is important to have the tokens able to be validated offline
> within some deployment specific time interval.  For some deployment "99
> years" is exactly what is desired, for other deployments having to be online
> is what is desired.
> 
> The missing piece is enrollment of devices (must be online), and associated
> with that is the initial exchange of authorization tokens.
> 
> My view is that "enrollment" is really about establishment of the "superuser"
> authorization token in the AS. In kerberos terms, it's the Ticket Granting
> Ticket.
> 
> --
> Michael Richardson <[e-mail]>, Sandelman Software Works
>  -= IPv6 IoT consulting =-
> 
> 
>