Re: [Isms] What granularity of attributes do we need forthe securetransport?

[Juergen Schoenwaelder <j.schoenwaelder at jacobs-university.de>]

On Tue, Apr 08, 2008 at 07:23:58PM -0400, David Harrington wrote:
 
> If I have the relationship between the NAS (RADIUS client) and the
> RADIUS server correct, then the NAS asks the RADIUS server how the
> service to be provided must be provisioned before providing that
> service to the authenticated entity. In the case of the SSHTM, the
> service we are looking to have authorized is an SSH subsystem over
> which we want to run an SNMP session. It is specifically the SSHTM
> that is asking whether an SSH subsystem is authorized for this user. I
> don't know how we provide a "hint" that an SSH subsystem is what we
> want, without having an attribute to specify that is the protocol we
> are interested in running SNMP over. 

I think this thinking is backwards. RADIUS is not a provisioning
protocol as far as I can tell.

Since the secure transport already exists when RADIUS comes into play,
all we can reasonably do is ship information about the actual secure
transport to the RADIUS server so that the RADIUS server can take this
into account when it takes a decision.

Radius experts, please correct me if I got this wrong.

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>
_______________________________________________
Isms mailing list
Isms at ietf.org
https://www.ietf.org/mailman/listinfo/isms