Re: [radext] Server identity and RFC7585bis (was: Review of draft-ietf-radext-radiusdtls)

["Mark Grayson (mgrayson)" <[e-mail]>]

As it relates to 7585, WBA recently had to clarify the same in terms of cache TTL,
but also recommendation on maximum TCP lifetime for dynamic connections:

there are some scenarios where significant traffic between access providers
and identity providers means any idle timeout is never triggered and the
dynamic connection becomes persistent, which then prevents the identity
provider from gracefully terminating connections on an old server instance.


  *   M

From: radext <[e-mail]> on behalf of Jan-Frederik Rieckers <[e-mail]>
Date: Wednesday, 10 April 2024 at 08:35
To: [e-mail] <[e-mail]>
Subject: [radext] Server identity and RFC7585bis (was: Review of draft-ietf-radext-radiusdtls)


On 20.03.24 03:55, Jan-Frederik Rieckers wrote:
>>     ... If a RADIUS/(D)TLS client has multiple connection to a server,
>> it MUST NOT decide to mark the whole server as DOWN until all
>> connections to it have been marked DOWN.
>>
>>    Maybe add a discussion of what, exactly, is a "server". Destination
>> IP?  How is this affected by RFC 7585 dynamic DNS lookups?
>
> I've added a TODO for after the IETF.

I've started to write a section to explain how a server is uniquely
identified, but I am failing to come up with anything other than
destination IP address and destination port.
Is there some better qualifier?

I'm not sure if this warrants a whole section "Server Identity" which
basically just says "If it's the same IP addr and port, its the same
server".

This would probably still be the same with dynamic lookups. If you
already have a standing session with the server, then you wouldn't need
to open a new connection. Just save the reference to the server in your
dynamic lookup table.


This also opens up the discussion about RFC 7585 again.
This is currently an experimental RFC too, with one Erratum in "hold for
document update", so we could issue a -bis document there too.

I'd be happy to get the ball rolling on that one too, if there is interest.


Cheers,
Janfred
--
Herr Jan-Frederik Rieckers
Security, Trust & Identity Services

E-Mail: [e-mail] | Fon: [phone] | Fax: [phone]
Pronomen: er/sein | Pronouns: he/him
__________________________________________________________________________________

DFN - Deutsches Forschungsnetz | German National Research and Education
Network
Verein zur Förderung eines Deutschen Forschungsnetzes e.V.
Alexanderplatz 1 | 10178 Berlin
https://www.dfn.de

Vorstand: Prof. Dr.-Ing. Stefan Wesner | Prof. Dr. Helmut Reiser |
Christian Zens
Geschäftsführung: Dr. Christian Grimm | Jochem Pattloch
VR AG Charlottenburg 7729B | USt.-ID. DE 136623822