[Isms] Moving into some design / architecture issues of Extended VACM

["Dave Nelson" <d.b.nelson at comcast.net>]

Randy Presuhn writes...

> (1) the RADIUS authorization data includes the name of the
> group of which this user is an authorized member.  (You can
> call it a policy if you will, but to break out of chicken--egg
> provisioning problems it must be possible to transform it into
> a VACM group name without any prior configuration.)

I don't think the "without any prior configuration" part works.  A group
name or policy name, whatever we call it, is just short-hand for a
potentially long list of policy rules or access control rules.  There's no
practical way that the RADIUS server can know what group names exist on the
NAS and what access rights they convey.  That has to be pre-arranged by the
system administrator.  Similarly, there's no way that the NAS can intuit the
correct set of policy rules from the name.  The name, IMHO, must simply be a
label and MUST NOT be encoded with actual access control semantics.
 
> (2) if one does not already exist, a corresponding entry is created
> in the vacmSecurityToGroupTable.

That, I think, is a potential security hole that you could drive a whole
fleet of trucks through.  Creating a table entry with some default, null or
wildcard set of access control rules seems like a very bad idea.  It's good
for ease-of-use, but bad for security.