Re: [netconf] Latest ietf-netconf-server draft and related modules

[Kent Watsen <[e-mail]>]

Hi Juergen,

>> How about this (the last sentence), in ietf-ssh-client?
>> 
>>        The credentials are unordered.  Clients may initially send
>>         any configured method or, per RFC 4252, Section 5.2, send
>>         the 'none' method to prompt the server to provide a list
>>         of productive methods.  Whenever a choice amongst methods
>>         arises, implementations SHOULD use a default ordering that
>>         prioritizes automation over human-interaction.

Not directed at Juergen, but I’ll assume that the last sentence is fine.


> I find the terminology at several places confusing. We have been
> talking about the order in which user authentication methods are
> tried. This has nothing to do with 'credential' ordering.
> 
> In draft-ietf-netconf-ssh-client-server-23.txt, I see
> 
>   *  The "client-identity" node configures a "username" and
>      credentials, each enabled by a "feature" statement defined in
>      Section 3.1.1.

Replaced “credentials” with "authentication methods”
   - for both modules and the draft itself


> Why is this called 'client-identity', should this not be called
> user-authentication instead to align with SSH terminology?
> 
> The guarding features likely also should have different names:
> client-identity-publickey -> userauth-publickey
> client-identity-password -> userauth-password
> client-identity-hostbased -> userauth-hostbased
> client-identity-none -> userauth-none
> 

In ietf-ssh-client, renamed "client-identity-*" to "userauth-*"
In ietf-ssh-server, renamed "client-auth-*" to "userauth-*"


Thanks,
Kent