[Isms] comments on draft-nelson-isms-extended-vacm-00

[Juergen Schoenwaelder <j.schoenwaelder at jacobs-university.de>]

Hi,

here are a few comments (posted as a technical contributor) on the
RADIUS / VACM document:

A: How specific should the document refer to the TSM? Should we try to
   phrase things such that things still work in case we replace TSM
   with something else?

B: I suggest that we do not overwrite existing table entries.

C: The aging I think needs more work so that we can handle situations
   where user joe logs into an agent at t1 and a second time at t2 and
   then the first session ends at t3. The second session should not
   loose the group name mapping entry in this case. So implementations
   somehow need to do some reference counting.

D: I am not sure why the USM discussion in the security considerations
   section is needed.

E: Is there a need for a MIB module exposing an augmentation of the
   VACM table with session/timeout information? Such a table would
   allow a management application that is aware of this extension to
   detect where some name to group mapping entries are originating
   from. But on the other hand, we do not generally indicate where
   some config snippet is originating from in SNMP land...

Though we will have time to discuss things later today in the WG
meeting, I brought this to the list since not all contributors and in
particular the document editors make it to Stockholm.

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>