Re: [lmap] AD evaluation: draft-ietf-lmap-information-model-16

Juergen,

> On Jan 25, 2017, at 4:18 AM, Juergen Schoenwaelder <j.schoenwaelder@jacobs-university.de> wrote:
> 
> Trevor,
> 
> this is also the explanation I came up with but the document does not
> really explain this. Alissa, would this resolve your comment if I try
> to add text that tries to explain this distinction? Would it help to
> add examples?

Explanation and examples would help, especially if some clear delineation about what belongs in each credential set can be given, albeit while remaining generic. But the bigger question is ...

> 
> - SSH host keys are I think examples of MA credentials while SSH user
>  authentication keys and authorization lists are channel
>  credentials.
> 
> - X.509 certificates defining trust to X.509 root authorities are
>  examples of MA credentials. while X.509 client ceritifcates for TLS
>  communication are channel credentials.

… can you explain why you want the controller to be able to change each of these on the MA, from how they were pre-configured?

Thanks,
Alissa

> 
> (Lets see whether I got this right. ;-)
> 
> /js
> 
> On Wed, Jan 25, 2017 at 09:02:11AM +0000, trevor.burbridge@bt.com wrote:
>> Initially the MA credentials were the private credentials of the MA and the channel credentials were the public credentials for each channel end-point.
>> 
>> Trevor.
>> 
>> -----Original Message-----
>> From: Juergen Schoenwaelder [mailto:j.schoenwaelder@jacobs-university.de] 
>> Sent: 24 January 2017 20:28
>> To: Burbridge,T,Trevor,TUB8 R <trevor.burbridge@bt.com>; Eardley,PL,Philip,TUB8 R <philip.eardley@bt.com>
>> Cc: lmap@ietf.org; Alissa Cooper <alissa@cooperw.in>
>> Subject: Re: [lmap] AD evaluation: draft-ietf-lmap-information-model-16
>> 
>> Trevor and Phil,
>> 
>> do you recall the reason why we have channel credentials and MA global credentials? How are the MA global credentials supposed to be used?
>> 
>> /js
>> 
>> On Tue, Jan 24, 2017 at 11:03:11AM -0500, Alissa Cooper wrote:
>>> 
>>>> On Jan 23, 2017, at 2:22 PM, Alissa Cooper <alissa@cooperw.in> wrote:
>>>> 
>>>> (2) Are ma-preconfig-credentials and ma-config-credentials meant to be credentials only for the MA to be authenticated by a Controller or Collector? I assume that the credentials that allow the MA to authenticate other endpoints, and to protect communications to those endpoints, are stored in ma-channel-credentials, but it would help to clarify which set of credentials each of these fields is referring to.
>>> 
>>> Just to reinforce this, now that I’m doing a review of draft-ietf-lmap-yang: it seems that the model in draft-ietf-netconf-netconf-client-server defines both the client and server credentials. So if that is supposed to fulfill the channel credentials in the information model, what happens if the ma-config-credentials for the MA are different than the ones in the ma-channel-obj for the MA? Which ones is the MA supposed to use?
>>> 
>>> Thanks,
>>> Alissa
>>> _______________________________________________
>>> lmap mailing list
>>> lmap@ietf.org
>>> https://www.ietf.org/mailman/listinfo/lmap
>> 
>> -- 
>> Juergen Schoenwaelder           Jacobs University Bremen gGmbH
>> Phone: +49 421 200 3587         Campus Ring 1 | 28759 Bremen | Germany
>> Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>
>> _______________________________________________
>> lmap mailing list
>> lmap@ietf.org
>> https://www.ietf.org/mailman/listinfo/lmap
> 
> -- 
> Juergen Schoenwaelder           Jacobs University Bremen gGmbH
> Phone: +49 421 200 3587         Campus Ring 1 | 28759 Bremen | Germany
> Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>