Re: [Isms] ISMS session summary

On Thu, Jul 13, 2006 at 08:39:19PM +0200, Eliot Lear wrote:

> A simple approach to take here would be to say that if you're using
> Kerberos to authenticate you must fill in appropriate VACM tables OOB. 
> This would, therefore, involve a bunch of null functions for Kerberos.

Two observations:

(a) The security name to group name mapping is a VACM feature and once
    you are in VACM in our architecture, you surely do not know
    anymore what was actually used down there in the SSH layer to
    actually perform the authentication. We do have a layered
    architecture and we should not break up those layers.

(b) Our charter currently says:

    Work on new access control models or centralized administration of
    View-based Access Control Model (VACM) rules and mappings is outside
    the scope of the working group.

As much as I understand the desire to have a security name to group
name mapping coming from AAA, it seems that we are currently not
chartered to provide it. Note that relevant RADIUS attributes have
been proposed to the radext WG and people really interested to have
support should read

	draft-nelson-radius-management-authorization-03.txt

and help David Nelson to move this document along in RADEXT.

/js

-- 
Juergen Schoenwaelder		    International University Bremen
<http://www.eecs.iu-bremen.de/>	    P.O. Box 750 561, 28725 Bremen, Germany

_______________________________________________
Isms mailing list
Isms@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/isms