[pcp] Server's auth policy discovery

[Alper Yegin <[e-mail]>]

Hello,

Let me compile the auth policy discovery solutions that were discussed on the ML so far.


There are 3 possible auth policies on a PCP server
1. auth not used (not supported, or disabled)
2. use of auth is optional (i.e., PCP Client's decision)
3. auth is mandatory to use

The question is, how does the PCP client know the server's policy.


With the tunneled PANA approach:

The client starts with either unauthenticated PCP or PANA-over-PCP, then observes what it gets back from the server. Either an error, or progress of what it started.

With the port-sharing PANA approach:


PCP client starts without using auth, and observes what happens.
If the server policy is 1 or 2, then PCP works without a problem.
If the server policy is 3, then the PCP server returns an appropriate error message.


Now, coming to Sam's scenario where it is not acceptable for some PCP clients to operate in unauthenticated mode.
He said this is needed for the firewall case.

In that case, DHCP-based discovery needs to be used (irrespective of the auth scenario), as the firewall is not necessarily the first-hop router from PCP Client's perspective.
We can update the DHCP-based discovery solution to deliver "auth policy" of the PCP server along with the "IP address of the server".

In addition to DHCP-based solution, or alternatively, we can define an ANNOUNCE-based single round-trip between the PCP client and PCP server for the client to discover the server's auth policy before proceeding. 


Alper