Re: [HOKEY] WGLC on draft-ietf-hokey-arch-design

[Glen Zorn <[e-mail]>]

On 9/2/2011 8:59 AM, Qin Wu wrote:

>> On 8/10/2011 10:38 AM, Zhen Cao wrote:
>>> I have read the latest (draft-ietf-hokey-arch-design) version of this
>>> draft and think it is ready for publication. However I have some
>>> additional comments to this draft below:
>>> Section 1, It said
>>> "
>>> whereas in AAK the client interacts with the AAA to discover and
>>> connect to CAPs.
>>> "
>>> [Z]: How to understand "discover"? It seems for AAK, there are
>>> potentially two possible cases.
>>> case 1: the client has already discovered a list of CAPs and negotiate
>>> with the AAA to choose one appropriate CAP from the CAPs list.
>>> case 2: the client only knows a layer-2 identifier as index and then
>>> the client use index to lookup appropirate CAP by interacting with the
>>> AAA. which case is correct?
> 
> [Qin]: My understanding is ,in AAK, SAP is capable of discovering CAPs 
> and is not necessary to rely on client based CAP discovery.

Actually, I think that CAP discovery is completely out of the scope of
hokey; what might be in scope would be the nature of the data that is
obtained as a result of discovery (name, address, etc.) but that may not
belong in this document.

...

>>> Section 3.1.2 "Minimized User Interaction for authorization"
>>> [Z]: This section seems redundant since the previous section has
>>> already cover this case. 
>>
>> Is that really so, though?  Minimizing the communication with home
>> servers doesn't seem to imply minimizing user interaction to me, but
>> maybe I'm wrong.
> 
> [Qin]: You are not wrong, one use case is in AAK, SAP communicate with the client on one side,
> while SAP interaction with the AAA on the other side. With this case, we can
> see minimizing the SAP communcation with the home servers does not means minimizing user interaction
> between the SAP and the client.
> I remember in the meeting, it is suggested to change 
> "Minimized User Interaction for authorization"
> into
> "Minimized User Interaction for authentication"

Yes, that's been fixed in the newest version, I think.

>>> Suggest to merge section 3.1.2 into section
>>> 3.1.1 or just delete the section 3.1.2.
>>>
>>> Section 6:
>>> [Z]:In Quebec meeting, the case where multiple servers are located in
>>> the same domain has been
>>> well discussed. I am thinking if this case should be taken into
>>> account in this section or leave
>>> this case out of scope of hokey architecture?
>>
>> I was going to suggest putting it into the AAA considerations section
>> but their doesn't seem to be one ;-).
> 
> [Qin]: I thought multiple servers cases is relevant to ERP and should be 
> discussed in RFC5296bis document. It is not good to discuss the same issue
> in both two documents. Am I wrong?

I tend to agree with you.

...