[pcp] Additional requirements for PCP Authentication.

[Ted Lemon <[e-mail]>]

I've mentioned this before, and got a response from Sam Hartman, but then the discussion died down.   Stephen Farrell raised the following DISCUSS points with respect to the PCP DHCP option:

(2) How can PCP authentication (based on the WG draft,
draft-ietf-pcp-authentication I assume?) make sense
with this use of DHCP? I guess that that can make
sense but I'm not getting it right now sorry. Can you
explain? (Note: its quite possible no change is
needed, just to explain the plan to a semi-ignorant
AD:-)

(3) How does a client know that the security identity
of one, some of all of the PCP server addresses
returned are the same or not? (You might cover this as
part of discuss point 2 above, not sure.)

I think that the PCP authentication needs to have the ability to provide an identifier to the client that the client can use to choose which credentials to provide to the PCP server in order to address point 3.   So I'd like to ask the working group whether they agree or disagree with this.

Secondly, in order to address point 2, the authentication protocol needs to have some text talking about how to use it in the context of dynamically-discovered PCP server addresses.   I think that if my suggestion above is taken, then it can work, and it's useful: by configuring PCP server addresses with DHCP, we avoid having to have the client maintain a static mapping between server IP addresses and credentials, which I think would be a bad idea anyway.   So a site that uses PCP authentication can use DHCP to configure PCP, and clients will be able to authenticate using pre-configured credentials.

Does this make sense?