Re: [Netconf] username from X.503 was Re: Summary of and AIs from the NETCONF Session in IETF #91

[Kent Watsen <[e-mail]>]

>> 
>> 
>> > Describe algorithm for extracting a user name out of the X509
>> attributes
>> >    - loud humm in favor
>> >
>> 
>> A clarification - does this mean that this algorithm goes in
>> netconf-server?
>>
>
>The idea (as far as I understood it) is that NC over TLS provides a
>high-level description of the algorithm. The NC server configuration
>document will define the YANG objects to configure this.


I didn't articulate clearly enough at the mic about the "what" and
"how", but Juergen agreed so I'm sure not that he's a mindreader  ;)

Anyway, in reflecting on this, I realized what I should've said
is that it should be whatever is needed so that 5539bis has an
Informative (not Normative) reference to server-model.   Again,
this is the necessary because alternate configuration models can
exist, thus it doesn't make sense to me for 5539bis to say that
it can *only* be configured by just the server-model.

My hope is that 5539bis will assert that client-certs are required
and specify that servers must be configurable to know how to extract
a username using the various options (specified, subAltName, DNS,
etc.).   Another option is for 5539bis to have a Normative reference
onto draft-ietf-netmod-snmp-cfg, section 4.1, though that may be too
convoluted for some.

Kent