Re: [Anima-bootstrap] section 5.1 -- redirection

> On Oct 17, 2016, at 7:47 AM, Michael Richardson <mcr+ietf@sandelman.ca> wrote:
> 
> 
> Max, I'm doing the minutes, and I'm trying to explain the confusion we had
> over the various objects by connecting to the real text, and I came across this.
> 
> Section 5.1 includes the text:
> 
>   As indicated in EST [RFC7030] the bootstrapping server can redirect
>   the client to an alternate server.  If the New Entity authenticated
>   the Registrar using the well known URI method then the New Entity
>   MUST follow the redirect automatically and authenticate the new
>   Registrar against the redirect URI provided.  If the New Entity had
>   not yet authenticated the Registrar because it was discovered and
>   was not a known-to-be-valid URI then the new Registrar must be
>   authenticated using one of the two autonomic methods described in
>   this document.  Similarly the Registar MAY respond with an HTTP 202
>   ("the request has been accepted for processing, but the processing
>   has not been completed") as described in EST [RFC7030] section 4.2.3.
> 
> I'm trying to understand how/when the New Entity would authenticate the
> registrar using the well known URI.  Is this for some form of mitigation,
> where the new entity does not (can not) do all of the proxy steps and a human
> helps via craft console?  Or is this part of the rekey state machine?

Including a well known URI as the final discovery attempt allows the client state machine and code base to support a model where it is booted on an unsecured (unknown) network where nothing local responds to discovery attempts. This use case support any home or small-business style device that might use a cloud management model. 

The redirect is an implied case by using HTTP and, for EST, we were asked to indicate what the appropriate behavior would be. Here the same idea applies *plus* note that this allows an inversion of the proxy model for the above use case. The device reaches out to a cloud service first and gets redirected to a local service. 

- max

> 
> 
> --
> Michael Richardson <mcr+IETF@sandelman.ca>, Sandelman Software Works
> -= IPv6 IoT consulting =-
> 
> 
> 
> _______________________________________________
> Anima-bootstrap mailing list
> Anima-bootstrap@ietf.org
> https://www.ietf.org/mailman/listinfo/anima-bootstrap