Subject: RE: [Isms] Network management authorization

From: "Nelson, David" <[email-masked]>
Date: Wed, 12 Jan 2005 15:47:14 -0500

> That, however, I disagree with.  I see no problems with accepting the
> authentication provided by a remote entity and certifying that a
> request is authentic to the person "david" using radius, but I may
> have a local notion of what I want the person I now know
> authoritatively as "david" to be able to do.

I would have to see some details of how the binding of the authenticated
identity to the local policy is to be accomplished before I could
comment further.

> The centralized service did not have the membership
> information, nor does it even today 5 years+ later. 

Yes, but Kerberos is not an AAA service.  It is an Authenticated Key
Management Service, and an Authentication Service. Last time I looked,
Kerberos had no concept of Authorization (not to mention Accounting.
I'm sure there are secure methods of binding the Kerberos identity with
the local policy source's notion of identity.  If one is using an AAA
service, then one ought to use the Authorization component thereof for
its intended purpose.  If all one has is an authentication service, then
extra work is required to "bolt-on" authorization, and I think we all
agree that the method of doing so must provide a strong binding (most
likely a cryptographic binding).

-- Dave

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: Wes Hardaker <[email-masked]>
Date: Wed, 12 Jan 2005 12:52:26 -0800

>>>>> On Wed, 12 Jan 2005 15:47:14 -0500, "Nelson, David" <[email-masked]> said:

David> Last time I looked, Kerberos had no concept of Authorization
David> (not to mention Accounting.

Don't worry, it still doesn't.  However, my example was about a
scenario, not that it used kerberos (I should have made it generic;
sorry).

-- 
Wes Hardaker
Sparta