[SECMECH] AAA requirement for middleware

[Josh Howlett <[e-mail]>]

Cross-realm AAA over RADIUS is growing extremely rapidly in my
environment (UK & European academic networking); for example, see
http://www.eduroam.org. This is being driven by an inter-Campus national
and international roaming requirement.

There is growing interest in re-using this infrastructure for
cross-realm Middleware functionality for other applications (thereby
providing similiar functionality to M/W architectures such as
Shibboleth).

However, there are no available means to provide an equivalent degree
of security as that provided by tunnelled EAP methods over EAPOL.

To a naive observer, it seems that what is required is a means of
encapsulating EAP in-band over TCP for application protocols. There is
a proposal from Funk et al (TLS/IA) to implement this within the TLS
handshake. Something of this ilk - perhaps ideally an EAP over SASL
mechanism - would be very welcome.

best regards, josh.

------------------------------------------------------------
Josh Howlett, Networking & Digital Communications,
Information Systems & Computing, University of Bristol, U.K.
'phone: [phone] email: [e-mail]
------------------------------------------------------------











_______________________________________________
SECMECH mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/secmech