Subject: RE: [Isms] Discussion: Architecture direction for ISMS

From: "Blumenthal, Uri" <[email-masked]>
Date: Fri, 15 Apr 2005 11:56:44 -0400

Martin, I don't know RADIUS well enough - but if RADIUS User-Name is
just the name that RADIUS just authenticated, then it's not what we need
here. If returned User-Name may be different from the original user
identity under which user asked RADIUS for authentication/authorization
- then it's OK.
 
________________________________

From: Martin Soukup [mailto:[email-masked]] 
Sent: Friday, April 15, 2005 8:53 AM
To: Blumenthal, Uri; [email-masked]'
Subject: RE: [Isms] Discussion: Architecture direction for ISMS

	Ah - yes. The return of this information (User-Name) in the
Access-Accept would be supported through configuration of any standard
RADIUS server.
	 
	martin.

		-----Original Message-----
		From: Blumenthal, Uri [mailto:[email-masked]] 
		Sent: Friday, April 15, 2005 10:58 AM
		To: Soukup, Martin [CAR:5K50:EXCH]; [email-masked]
		Subject: RE: [Isms] Discussion: Architecture direction
for ISMS

		Every existing infrastructure has its own way to
identify its users. More often than not, these identitites do not match.
One of the complaints wrt. SNMPv3 deployment is the fact that its set of
identities does not [necessarily] match those other ones - and thus user
datastore has to be filled during provisioning or configuration time.
Thus when a RADIUS user "msoukup" request SNMP access and is
authenticated+authorized, RADIUS must tell SNMP engine what identity to
use in the SNMP traffic packets. For USM, it could be dynamically
created entry with usmUserName=usmSecurityName="msoukup", or a reference
to an already-existing one (then RADIUS should tell which, or there
should be a rule by which the SNMP engine can figure it out by itself).
For other systems - perhaps they can be made to just directly take the
identity that RADIUS just authorized - but I don't think it would be any
easier.

________________________________

			From: [email-masked]
[mailto:[email-masked]] On Behalf Of Martin Soukup
			Sent: Friday, April 15, 2005 4:10 AM
			To: [email-masked]
			Subject: RE: [Isms] Discussion: Architecture
direction for ISMS

			RADIUS "Access-Accept" indicates a successful
authenthentication response for a user. 

			The Access-Accept already returns a
"Session-Timeout", defined as "Sets the maximum number of seconds of
service to be provided to the user before the session terminates. This
attribute value becomes the per-user "absolute timeout."".

			RADIUS is commonly used to return policy (e.g.
VACM group mapping) and specific uses have been standardized. 

			This definitely fits well with EUSM, if
something which can be tunneled over RADIUS can generate the key
binding. This is why I like RADIUS.

			Uri, I'm not entirely sure what you meant by
"identity to use" below since authentication presumes an identity was
already provided?

			Martin. 

			> -----Original Message----- 
			> From: [email-masked] 
			> [mailto:[email-masked]] On Behalf
Of Randy Presuhn 
			> Sent: April 14, 2005 8:37 PM 
			> To: [email-masked] 
			> Subject: Re: [Isms] Discussion: Architecture
direction for ISMS 
			> Hi - 
			> > From: "Blumenthal, Uri"
<[email-masked]> 
			> > To: "Thierry Moreau"
<[email-masked]> 
			> > Cc: <[email-masked]> 
			> > Sent: Thursday, April 14, 2005 5:22 PM 
			> > Subject: RE: [Isms] Discussion: Architecture
direction for ISMS 
			> ... 
			> > So in case of RADIUS, the "access granted"
should be accompanied by: 
			> > 
			> >  - generated fresh keying for this session
(including its 
			> life-time); 
			> >  - identity to use for this connection (as
probably nobody wants to 
			> > configure user database on the SNMP agent
:-); 
			> >  - mapping of that identity onto an existing
VACM group. 
			> ... 
			> 
			> Sounds a lot like EUSM.  (not that that'd be a
bad thing) 
			> Randy 
_______________________________________________ 
			> Isms mailing list 
			> [email-masked] 
			> https://www1.ietf.org/mailman/listinfo/isms 
			> 
			> 

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: "David T. Perkins" <[email-masked]>
Date: Fri, 15 Apr 2005 10:23:44 -0700 (PDT)

HI,

In URI's message below, he has the the example
"For USM, it could be dynamically created entry with
 usmUserName=usmSecurityName="msoukup" ..."

This would not work! If one was to attempt to "reuse USM", then
on session establishment, session keys would be created and
a session identifier would be created. The session identifier
(when reusing USM) HAS GOT TO BE the msgUserName field of
the UsmSecurityParameters sequence (which is the value of
of the msgSecurityParameters field of SNMPv3 messages.
The value of msgUserName name would be temporal, lasting
only the duration of the session, but also unique during
its existance.

Regards,
/david t. perkins