Re: [Isms] Multi-namespace authentication

[Jeffrey Hutzelman <jhutz at cmu.edu>]

> DBN> However, if an operator is using *both* SSH and TLS, for example, 
with
> DBN> disjoint user databases having disjoint namespaces, the only ways to
> DBN> fix that issue "in the transport" would be to either synchronize the
> DBN> namespaces (i.e. either de jure or de facto single-sign on) or to
> DBN> incorporate some form of administrative "realm" element in the user
> DBN> name.  An example of such a construct may be found in the Network
> DBN> Access identifier [RFC 4282].
>
> And a solution like that makes sense.  If every secure TM transport had
> to hand up a securityName from below formatted something like
> "user at TMTOKEN" where TMTOKEN was SSH, DTLS, TLS or whatever was defined
> by the TM transport then it would solve the uniqueness problem in a very
> very easy way.

This is pretty much exactly what I proposed, but with a different syntax.
I don't have a strong reason to prefer one syntax over the other, though I
think it is slightly more intuitive not to use '@' to introduce things
other than domain names.

-- Jeff
_______________________________________________
Isms mailing list
Isms at ietf.org
https://www.ietf.org/mailman/listinfo/isms