Re: [Isms] Moving into some design /architectureissuesofExtendedVACM

[Juergen Schoenwaelder <j.schoenwaelder at jacobs-university.de>]

On Thu, Jun 11, 2009 at 10:55:09PM +0200, Randy Presuhn wrote:
 
> > But the minimum we have to do is to specify what the RADIUS client
> > does if the creation fails.
> 
> Yup, and I think the answer is "nothing."  There's no channel for
> signalling back the failure.  From an implementation perspective,
> if there aren't resources to create/update a vacmSecurityToGroupEntry,
> then I'd be wary of trying to do things like queue up special-purpose
> notifications for the security administrator, who'd be the one who'd have
> to figure out a recovery strategy.

I am talking in general about a failure to install the requested
policy / name to group mapping - not just about the resource shortage
case.

Suppose the RADIUS server tells the RADIUS client that "joe" using
"TSM" is authorized for the management policy "restricted" but the
attempt of the RADIUS client to install this policy fails since for
some reason (e.g., there exists an entry for "joe" using "TSM" using
group "poweruser" that for whatever reason can't be modified). Is it
OK to ignore the failure and to let "joe" now use the "poweruser"
rights?  Or should the RADIUS client do something like deny
authentication of joe's session if it can't install the management
policy, or kill joe's session if it is already there (likely a
challenge to write down due to the architectural model we have, but
likely easy to implement ;-).

My understanding is that RADIUS decisions are of the kind "here is
exactly what you do or you deny service" (RADIUS folks, please correct
me if I am wrong). If this is the case, simply ignoring a failure to
install the requested policy sounds kind of wrong.

/js

PS: Does the RADIUS client have the "rights" to modify any existing
    writable matching table entries? Will it revert the changes when
    the session dies?

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>