Re: [Isms] Moving into some design/architecture issuesofExtendedVACM

["David Harrington" <ietfdbh at comcast.net>]

Hi,

I think we actually have consensus about persistence. 

I think everybody expects that the user-to-group mapping should go
away when the radius-authorized session ends; we just need to figure
how to do that without redesigning snmpv3 and the rfc3411
architecture. 

I do not think we have consensus on reverting.

dbh

> -----Original Message-----
> From: isms-bounces at ietf.org [mailto:isms-bounces at ietf.org] On 
> Behalf Of Dave Nelson
> Sent: Tuesday, June 16, 2009 8:39 AM
> To: isms at ietf.org
> Subject: Re: [Isms] Moving into some design/architecture 
> issuesofExtendedVACM
> 
> Juergen Schoenwaelder writes...
>  
> > I am familiar with envrionments where the SNMP configuration
> > is rather static and never changed unless really really really
> > necessary.
> 
> I suspect that this broadly applies to the access control 
> rules and the
> "roles" that are defined by the collections of rules, i.e. 
> the "groups".  I
> think that "roles" change very infrequently, once initially 
> debugged and
> tuned, unless something in the organization changes, such as 
> a different
> division of responsibilities or some new type of equipment with new
> management challenges is introduced.
> 
> I think it's fair to say that the group definitions are 
> semi-static, and
> managed by traditional SNMP access.  These definitions are 
> certainly *not*
> managed by RADIUS.
> 
> I also think it's fair to say that most organizations have 
> only a handful of
> roles / groups.  What changes most frequently is the 
> assignment of people to
> roles.  From all the postings to date, I believe we have 
> rough consensus on
> that much.
> 
> What seems to be in contention is *how* the dynamic 
> information from RADIUS
> is applied.
> 
> The issue that seems to be most contentions is whether the 
> securityName to
> groupName binding provided by RADIUS is persistent in the NAS 
> after the
> session has ended.  While this is the way SNMP works it is not the
way
> RADIUS works.  This is the root of the disagreement -- very
different
> persistence models between RADIUS provisioning and SNMP 
> provisioning.  Each
> camp naturally views the issues from their own experience 
> base and comfort
> zone.
> 
> How do we resolve this?
> 
> 
> _______________________________________________
> Isms mailing list
> Isms at ietf.org
> https://www.ietf.org/mailman/listinfo/isms
>