Re: [netconf] UserId for authentication in https-notif

[Schönwälder, Jürgen <[e-mail]>]

On Fri, Oct 11, 2019 at 12:15:01PM -0700, Mahesh Jethanandani wrote:
> Hi Balasz,
> 
> > On Oct 11, 2019, at 2:43 AM, Balázs Lengyel <balazs.lengyel=[e-mail]> wrote:
> > 
> > Hello,
> > What userId will be used to perform access control on outgoing notifications transferred via https?
> 
> This was also discussed in an earlier thread, when Martin brought up the broader question of whether we are planning on using PUT or POST, to which URI, and authorization. 
> 
> Kent suggested that user-id will be part of http-params supported by the http client/server draft, and will be the user-id used by NACM. The example in the draft will be augmented thus:
> 
> <receivers
>      xmlns="urn:ietf:params:xml:ns:yang:ietf-https-notif">
>      <receiver>
>        <name>foo</name>
>        <tcp-params>
>          <remote-address>my-receiver.my-domain.com <http://my-receiver.my-domain.com/></remote-address>
>          <remote-port>443</remote-port>
>        </tcp-params>
>        <tls-params>
>          <server-authentication>
>            <ca-certs>explicitly-trusted-server-ca-certs</ca-certs>
>            <server-certs>explicitly-trusted-server-certs</server-certs>
>          </server-authentication>
>        </tls-params>
>        <http-params>
>          <client-identity>
>            <basic>
>              <user-id>my-name</user-id>
>              <password>my-passsord</password>
>            </basic>
>         </client-identity>
>         <path>/some/path</path>
>        <http-params>
>      </receiver>
>  </receivers>
>

Are you saying that the idea is to configure a user id on the local RC
server pushing notifications to a remote receiver, i.e., the user id
is by config related to the certs used to protect the communication
channel?

Note that RFC 7589 (NC over TLS) suggests an algorithm mapping
certificates to user names. RFC 8040 (RC) also refers to this
algorithm for obtaining the client identity. [Is this algorithm
actually taken care of in the configuration IDs?]

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: [phone]         Campus Ring 1 | 28759 Bremen | Germany
Fax:   [phone]         <https://www.jacobs-university.de/>