[netconf] Question about NACM username for configured-subscription receivers

[Roman Janota <[e-mail]>]

Hi all,

I'd like to clarify how RFC 8341 (NACM) is supposed to apply to configured subscriptions under RFC 8639, in particular when the transport is draft-ietf-netconf-udp-notif. I've read the three documents together and there is a gap I cannot resolve from the text.

Under RFC 8639 §2.5, configured subscriptions are managed purely through configuration: any client with write permission on /subscriptions can create a receiver-instance and a subscription targeting any event stream the publisher exposes. UDP-Notif defines the receiver-instance transport parameters (remote-address, remote-port, local-address, local-port, dtls), but nothing identity related.

RFC 8639 §2.1 says access control may silently exclude event records for which the receiver has no read access, and §8 lists the “stream" leaf as sensitive because it "could set a subscription to an event stream that does not contain content permitted for the targeted receivers.” - so per receiver read checks are clearly assumed.

My question is where the NACM username comes from. RFC 8341 ties the username to the transport layer during session establishment. For a dynamic subscription the model fits: the receiver is the subscriber, bound to a transport session. For a configured subscription over UDP-notif there is no NETCONF/RESTCONF session associated with the receiver at delivery time, and DTLS gives the publisher no NACM username for the receiver (unless we were to perform some form of cert-to-name mechanism?). As far as I can tell, none of the three documents defines how to obtain the username against which NACM should evaluate the receiver's read access.

Am I missing something in the existing specs, or is this genuinely undefined? Guidance would be appreciated.

Thank you,

Roman Janota