Re: [lmap] AD evaluation: draft-ietf-lmap-information-model-16

Trevor,

this is also the explanation I came up with but the document does not
really explain this. Alissa, would this resolve your comment if I try
to add text that tries to explain this distinction? Would it help to
add examples?

- SSH host keys are I think examples of MA credentials while SSH user
  authentication keys and authorization lists are channel
  credentials.

- X.509 certificates defining trust to X.509 root authorities are
  examples of MA credentials. while X.509 client ceritifcates for TLS
  communication are channel credentials.

(Lets see whether I got this right. ;-)

/js

On Wed, Jan 25, 2017 at 09:02:11AM +0000, trevor.burbridge@bt.com wrote:
> Initially the MA credentials were the private credentials of the MA and the channel credentials were the public credentials for each channel end-point.
> 
> Trevor.
> 
> -----Original Message-----
> From: Juergen Schoenwaelder [mailto:j.schoenwaelder@jacobs-university.de] 
> Sent: 24 January 2017 20:28
> To: Burbridge,T,Trevor,TUB8 R <trevor.burbridge@bt.com>; Eardley,PL,Philip,TUB8 R <philip.eardley@bt.com>
> Cc: lmap@ietf.org; Alissa Cooper <alissa@cooperw.in>
> Subject: Re: [lmap] AD evaluation: draft-ietf-lmap-information-model-16
> 
> Trevor and Phil,
> 
> do you recall the reason why we have channel credentials and MA global credentials? How are the MA global credentials supposed to be used?
> 
> /js
> 
> On Tue, Jan 24, 2017 at 11:03:11AM -0500, Alissa Cooper wrote:
> > 
> > > On Jan 23, 2017, at 2:22 PM, Alissa Cooper <alissa@cooperw.in> wrote:
> > > 
> > > (2) Are ma-preconfig-credentials and ma-config-credentials meant to be credentials only for the MA to be authenticated by a Controller or Collector? I assume that the credentials that allow the MA to authenticate other endpoints, and to protect communications to those endpoints, are stored in ma-channel-credentials, but it would help to clarify which set of credentials each of these fields is referring to.
> > 
> > Just to reinforce this, now that I’m doing a review of draft-ietf-lmap-yang: it seems that the model in draft-ietf-netconf-netconf-client-server defines both the client and server credentials. So if that is supposed to fulfill the channel credentials in the information model, what happens if the ma-config-credentials for the MA are different than the ones in the ma-channel-obj for the MA? Which ones is the MA supposed to use?
> > 
> > Thanks,
> > Alissa
> > _______________________________________________
> > lmap mailing list
> > lmap@ietf.org
> > https://www.ietf.org/mailman/listinfo/lmap
> 
> -- 
> Juergen Schoenwaelder           Jacobs University Bremen gGmbH
> Phone: +49 421 200 3587         Campus Ring 1 | 28759 Bremen | Germany
> Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>
> _______________________________________________
> lmap mailing list
> lmap@ietf.org
> https://www.ietf.org/mailman/listinfo/lmap

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1 | 28759 Bremen | Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>