Re: [Isms] pre11 comments

["David B. Nelson" <d.b.nelson at comcast.net>]

Jeffrey Hutzelman writes...

> In this way, the difference between an SSH user and a TLS user 
> becomes very clear in VACM, and the mapping from SSH username to 
> securityName and back is well defined.
> 
> Comments?

That may be useful for deployments where there are distinct namespaces for
SSH, TLS, Kerberos, Telnet, Unix login, and what-have-you.  I'm sure there
are such deployments.  On the other hand, another way to address the issue
of divergent namespaces is to use a single AAA service (or at least a single
back-end user database) for all authentication purposes within an
organization.  The ability to use existing AAA infrastructures (with a
common user namespace) was one of the primary goals of the ISMS work, no?

Universal single sign-on s still an elusive "holy grail" but it is often
achieved within the confines of a single organization.


_______________________________________________
Isms mailing list
Isms at ietf.org
https://www.ietf.org/mailman/listinfo/isms