Re: [OPSAWG] I-D Action: draft-ietf-opsawg-tacacs-tls13-01.txt

[heasley <[e-mail]>]

Wed, Nov 30, 2022 at 09:04:04PM -0800, [e-mail]:
> 
> A New Internet-Draft is available from the on-line Internet-Drafts directories.
> This draft is a work item of the Operations and Management Area Working Group WG of the IETF.
> 
>         Title           : TACACS+ TLS 1.3
>         Authors         : Thorsten Dahm
>                           Douglas Gash
>                           Andrej Ota
>                           John Heasley
>   Filename        : draft-ietf-opsawg-tacacs-tls13-01.txt
>   Pages           : 11
>   Date            : 2022-11-30
> 
> Abstract:
>    The TACACS+ Protocol [RFC8907] provides device administration for
>    routers, network access servers and other networked computing devices
>    via one or more centralized servers.  This document, a companion to
>    the TACACS+ protocol [RFC8907], adds Transport Layer Security
>    (currently defined by TLS 1.3 [RFC8446]) support and obsoletes former
>    inferior security mechanisms.
> 

This addresses two of the comments made by Joe Clarke.  Among which,
Joe asked that mishandling of the TAC_PLUS_UNENCRYPTED_FLAG in a TLS
connection be treated as FAIL, which means that the authen or author
failed and the client would stop and not proceed to other servers or
methods.

Upon reviewing to make this change, we concluded that this was not
quite the correct behavior, based on the current behavior of similar
errors in RFC8907 (S4.5 specifically), it should proceed to other servers
or methods.

So, the draft, in S4, now specifies returning ERROR rather than FAIL or
ignoring the deprecated flag.  Hopefully, this change agrees with
everyone.

We still have some operators/security considerations to address and the
issues raised by Alan.