Re: [Dime] Dime WG at IETF 113 / Vienna ??

[Alan DeKok <[e-mail]>]

On Mar 10, 2022, at 2:03 AM, Rick van Rein <[e-mail]> wrote:

  So far as I know DIME is mostly done.  There's no new work being planned.

> Documents:
> https://datatracker.ietf.org/doc/html/draft-vanrein-internetwide-realm-crossover

  Section 3 says:

   However, the NAI
   defaults to realm-internal use but BYOID always needs to express the
   domain, so the root of the grammar tree is different:

 The "realm-internal" phrase isn't defined anywhere.  From what I can guess, this claim isn't correct.

  RFC 7542 forbids the use of non-domain NAIs, e.g. "fred@sales".

  RFC 7542 allows for the use of domain names which can be resolved publicly (example.com), or ones which don't need to be resolved publicly (internal.example.com).  It's up to the domain to control which one is used.

  RFC 7542 Section 3 explicitly allows for routing to be done on a portion of the the domain name, a system gets "[e-mail]", and has a route for "example.com".  The users request is then routed to "example.com".

  So there appears to be no need for any new definitions.  Just use the format and methods which have already been defined.  Inter-domain auth routing is a solved problem.  The problem which isn't solved is *why* people would do it.

  Section 3 of your document also says:

   The utf8-username and utf8-realm are both considered to be case-
   insensitive, 

  This is not correct.  The utf8-realm is case sensitive, but RFC 7542 Section 3 says:

   As noted earlier,
   intermediate nodes may not have access to the same locale information
   as the system that injected the NAI into the AAA routing systems.
   Therefore, almost all "case insensitive" comparisons can be wrong.

  i.e. the uff8-username is explicitly defined to be site-local.  See Section 2.4:

   Interpretation of the username part of the NAI depends on the realm
   in question.  Therefore, the utf8-username portion SHOULD be treated
   as opaque data when processed by nodes that are not a part of the
   home domain for that realm.

  i.e. suggesting any content for the utf8-username is likely to not succeed.

> https://datatracker.ietf.org/doc/draft-vanrein-diameter-sasl/

  I already commented on the feasibility of a Diameter-bases global routing system in EMU a while ago.  My opinions haven't changed since then.

  If your proposal requires every domain to run a Diameter server, then it's dead in the water.  It's just not going to happen.

  Many people were pushing business-to-business roaming in the late 1990s.  It still hasn't happened.   For ISPs and Telcos, it's taken them ~15 years of work to see the value of something like OpenRoaming.

  History shows that no one sees a value in B2B roaming.  I would suggest concentrating on convincing people it has value, and also to switch to technologies which have a hope of being deployed.

  Alan DeKok.