Re: [OPSAWG] New Version Notification for draft-zheng-opsawg-tacacs-yang-02.txt

Hi Ebben,

Thank you for your important comments.
I will add this question to the open issue for discussion and ask our AD for further guidance.
Please see the specific response inline.

Thanks,
Bo

-----邮件原件-----
发件人: Ebben Aries [mailto:exa@arrcus.com] 
发送时间: 2019年7月11日 0:25
收件人: Wubo (lana) <lana.wubo@huawei.com>
抄送: wangzitao <wangzitao@huawei.com>; Zhengguangying (Walker) <zhengguangying@huawei.com>; opsawg@ietf.org
主题: Re: [OPSAWG] New Version Notification for draft-zheng-opsawg-tacacs-yang-02.txt

A few quick observations on the model

- The model defines the client configuration and state parameters only
  but to be functional for operator use w/ AAA needs a few other things,
  otherwise this by itself is incomplete
[Bo] Thanks again for your suggestion. You asked this question to us at the 103 meeting, and we submitted version 01 to solve this problem.
https://tools.ietf.org/html/draft-zheng-opsawg-tacacs-yang-01#section-4

Although the augmentation was proposed, the Opsawg WG believes that only the tacacsplus YANG is in scope, system-aaa augmentation is not.
In addition, there are also comments from Radius that system-aaa augmentation cannot solve only tacacsplus. 
So for this augmentation part model, I don't know what to do.

- There should likely be an identity of 'tacacsplus' that is base off
  ietf-system:authentication-method
[Bo] Yes. In the draft, we added:
identity tacacs {
     base sys:authentication-method;

We should define:
identity tacacsplus {
     base sys:authentication-method;

- The 'user-authentication-order' must restrictions in ietf-system would
  need to be accounted for as is done for radius
[Bo] Agree, ‘must’ statement should be added for tacacsplus feature.

- Is there intention to add an equivalent 'tacacsplus-authentication'
  feature much like there is for radius?
[Bo] Yes, but for the time being, we have not yet proposed the augmentation draft.  Or can we can added it as an appendix?
Thx

/ebben

On Jun 20 13:04 PM, Wubo (lana) wrote:
> Dear WG,
> 
> We update the 02 version of draft-zheng-opsawg-tacacs-yang-02 to address the comments from 104 meeting.
> https://tools.ietf.org/html/draft-zheng-opsawg-tacacs-yang-02
> 
> Here are some major changes in this version:
> -  This draft is focused on TACACS+ Client only YANG.
> -  Change the module name to ietf-system-tacacsplus.
> -  Group the all the rw objects together by changing timeout to server specific.
> -  Change "network-instance" to "vrf-instance" to make it specific and add text to describe it.
> -  Add "source-interface" as a choice to accommodate one more implementation.
> 
> Please help to review the document, comments and suggestions are welcome!
> 
> Thanks, 
> Bo
> 
> 
> -----邮件原件-----
> 发件人: internet-drafts@ietf.org [mailto:internet-drafts@ietf.org] 
> 发送时间: 2019年6月20日 20:38
> 收件人: wangzitao <wangzitao@huawei.com>; Wubo (lana) <lana.wubo@huawei.com>; Zhengguangying (Walker) <zhengguangying@huawei.com>; Wubo (lana) <lana.wubo@huawei.com>; wangzitao <wangzitao@huawei.com>
> 主题: New Version Notification for draft-zheng-opsawg-tacacs-yang-02.txt
> 
> 
> A new version of I-D, draft-zheng-opsawg-tacacs-yang-02.txt
> has been successfully submitted by Bo Wu and posted to the IETF repository.
> 
> Name:		draft-zheng-opsawg-tacacs-yang
> Revision:	02
> Title:		Yang data model for TACACS+
> Document date:	2019-06-20
> Group:		Individual Submission
> Pages:		14
> URL:            https://www.ietf.org/internet-drafts/draft-zheng-opsawg-tacacs-yang-02.txt
> Status:         https://datatracker.ietf.org/doc/draft-zheng-opsawg-tacacs-yang/
> Htmlized:       https://tools.ietf.org/html/draft-zheng-opsawg-tacacs-yang-02
> Htmlized:       https://datatracker.ietf.org/doc/html/draft-zheng-opsawg-tacacs-yang
> Diff:           https://www.ietf.org/rfcdiff?url2=draft-zheng-opsawg-tacacs-yang-02
> 
> Abstract:
>    This document defines a YANG modules that augment the System data
>    model defined in the RFC 7317 with TACACS+ client model.  The data
>    model of Terminal Access Controller Access Control System Plus
>    (TACACS+) client allows the configuration of TACACS+ servers for
>    centralized Authentication, Authorization and Accounting.
> 
>    The YANG modules in this document conforms to the Network Management
>    Datastore Architecture (NMDA) defined in RFC 8342.
> 
>                                                                                   
> 
> 
> Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org.
> 
> The IETF Secretariat
> 
> _______________________________________________
> OPSAWG mailing list
> OPSAWG@ietf.org
> https://www.ietf.org/mailman/listinfo/opsawg