Re: [pcp] Stephen Farrell's Discuss on draft-ietf-pcp-proxy-08: (with DISCUSS)

Hiya.

On 09/07/15 13:38, mohamed.boucadair@orange.com wrote:
> Re-,
> 
> Both modes you mentioned may be envisaged... 

Right. But I think there's no way to support both (as of
now at least), is that correct? (I'm not asking that both
be supported - it's probably over complex for the benefits
one could get.)

> but in term of
> requirements the wg discussed mainly the case where the left-most
> client authenticates with the middle server and the case where the
> left-most client does not even authenticate (but still the proxy
> authenticate to the upstream server).

So that's a credible answer. I do think it ought be stated
in this document though as it rules out a few things that
one could otherwise have done if the leftmost client could
be authenticated to the rightmost server. I'm not saying
the WG should have chosen any of the particular answers there
btw, but just that it needs to be clear, here.

> 
> The PCP auth draft says the following:

Ah thanks. Sorry for missing/forgetting that. Too much
too-quick reading;-)

> 
> When a PCP proxy is located between a PCP server and PCP clients,
> the proxy may perform authentication with the PCP server before it 
> processes requests from the clients.  In addition, re-authentication 
> between the PCP proxy and PCP server will not interrupt the service 
> that the proxy provides to the clients since the proxy is still 
> allowed to send common PCP messages to the PCP server during that 
> period.

Ok. So that doesn't quite preclude the leftmost client
authenticating to the rightmost server though. Shouldn't it?

Cheers,
S.

> 
> Cheers, Med
> 
>> -----Message d'origine----- De : Stephen Farrell
>> [mailto:stephen.farrell@cs.tcd.ie] Envoyé : jeudi 9 juillet 2015
>> 14:21 À : BOUCADAIR Mohamed IMT/OLN; The IESG Cc : pcp@ietf.org 
>> Objet : Re: [pcp] Stephen Farrell's Discuss on
>> draft-ietf-pcp-proxy-08: (with DISCUSS)
>> 
>> 
>> Hi Med,
>> 
>> On 09/07/15 12:58, mohamed.boucadair@orange.com wrote:
>>> Hi Stephen,
>>> 
>>> FWIW, the document does not include any discussion about 
>>> authentication as per slide 4 of 
>>> http://www.ietf.org/proceedings/87/slides/slides-87-pcp-2.pdf.
>>> Those aspects are out of scope of this document; implication
>>> assessment is supposed to be in the PCP auth draft.
>> 
>> Well, I don't believe the PCP auth draft says anything about PCP
>> proxies does it?
>> 
>> But I'm not asking about where/how we document stuff but rather 
>> about how it is supposed to work.
>> 
>>> 
>>> The answer to your question is in slide 3 
>>> (https://www.ietf.org/proceedings/87/slides/slides-87-pcp-6.pdf).
>>
>>
>>> 
Sorry, I don't get an answer to my question from that, can
>> you explain?
>> 
>> Ta, S.
>> 
>> 
>>> 
>>> Cheers, Med
>>> 
>>>> -----Message d'origine----- De : pcp
>>>> [mailto:pcp-bounces@ietf.org] De la part de Stephen Farrell
>>>> Envoyé : jeudi 9 juillet 2015 13:32 À : The IESG Cc :
>>>> pcp@ietf.org Objet : [pcp] Stephen Farrell's Discuss on
>>>> draft-ietf-pcp-proxy-08: (with DISCUSS)
>>>> 
>>>> Stephen Farrell has entered the following ballot position for 
>>>> draft-ietf-pcp-proxy-08: Discuss
>>>> 
>>>> When responding, please keep the subject line intact and reply
>>>> to all email addresses included in the To and CC lines. (Feel
>>>> free to cut this introductory paragraph, however.)
>>>> 
>>>> 
>>>> Please refer to 
>>>> https://www.ietf.org/iesg/statement/discuss-criteria.html for
>>>> more information about IESG DISCUSS and COMMENT positions.
>>>> 
>>>> 
>>>> The document, along with other ballot positions, can be found 
>>>> here: https://datatracker.ietf.org/doc/draft-ietf-pcp-proxy/
>>>> 
>>>> 
>>>> 
>>>> ----------------------------------------------------------------------
>>>>
>>>>
>>
>>>> 
DISCUSS:
>>>> ----------------------------------------------------------------------
>>>>
>>>>
>>>>
>>>>
>>
>>>> 
I have one thing I'd like to check. Maybe this just works fine,
>>>> but how does this function work with PCP authentication?  E.g.
>>>> in Figure 1, is the left-most client authenticating to the
>>>> middle or rightmost server? I think I could imagine either
>>>> answer being desirable and don't see a way that both could be
>>>> supported.
>>>> 
>>>> 
>>>> 
>>>> 
>>>> _______________________________________________ pcp mailing
>>>> list pcp@ietf.org https://www.ietf.org/mailman/listinfo/pcp