Re: [radext] Server identity and RFC7585bis (was: Review of draft-ietf-radext-radiusdtls)

[Alan DeKok <[e-mail]>]

On Apr 10, 2024, at 5:57 PM, Alexander Clouter <[e-mail]> wrote:
> I would recommend each connection is just treated (and described) as a *route* to the service endpoint.
> 
> It seems easier to read if you replace 'connection' with 'route' when reading it out loud. Connections provide *routes* to a server. When there are no routes, the 'server' (ie. 'service endpoint') is then DOWN.

  I think that's a good terminology.  It also matches the text in RFC 7542 (NAI) Section 3 "Routing inside of AAA systems"  https://datatracker.ietf.org/doc/html/rfc7542#section-3

  A client or proxy can put multiple "routes" into a connection pool.  The pool can contain UDP home servers, or DTLS / TLS home servers.  It doesn't matter.  The administrator has determined that these are all paths to the same home server.

  The standardization work here is how the client or proxy can automatically determine that certain routes end up at the home server.  One way is a signed certificate which claims to be the same server.

  e.g.  It is reasonable to expect that NAIs of the form "example.com" get routed to servers which have certificates in the domain "example.com".

  Alan DeKok.