Subject: RE: [Isms] Discussion: Architecture direction for ISMS

From: "Martin Soukup" <[email-masked]>
Date: Fri, 15 Apr 2005 07:10:03 -0400

RADIUS "Access-Accept" indicates a successful authenthentication response
for a user.

The Access-Accept already returns a "Session-Timeout", defined as "Sets the
maximum number of seconds of service to be provided to the user before the
session terminates. This attribute value becomes the per-user "absolute
timeout."".

RADIUS is commonly used to return policy (e.g. VACM group mapping) and
specific uses have been standardized.

This definitely fits well with EUSM, if something which can be tunneled over
RADIUS can generate the key binding. This is why I like RADIUS.

Uri, I'm not entirely sure what you meant by "identity to use" below since
authentication presumes an identity was already provided?

Martin.

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Randy Presuhn
> Sent: April 14, 2005 8:37 PM
> To: [email-masked]
> Subject: Re: [Isms] Discussion: Architecture direction for ISMS
> 
> 
> Hi -
> 
> > From: "Blumenthal, Uri" <[email-masked]>
> > To: "Thierry Moreau" <[email-masked]>
> > Cc: <[email-masked]>
> > Sent: Thursday, April 14, 2005 5:22 PM
> > Subject: RE: [Isms] Discussion: Architecture direction for ISMS
> ...
> > So in case of RADIUS, the "access granted" should be accompanied by:
> >
> >  - generated fresh keying for this session (including its 
> life-time);
> >  - identity to use for this connection (as probably nobody wants to 
> > configure user database on the SNMP agent :-);
> >  - mapping of that identity onto an existing VACM group.
> ...
> 
> Sounds a lot like EUSM.  (not that that'd be a bad thing)
> 
> Randy
> 
> 
> 
> 
> _______________________________________________
> Isms mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/isms
> 
> 
_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: Sam Hartman <[email-masked]>
Date: Fri, 15 Apr 2005 13:34:24 -0400

>>>>> "Martin" == Martin Soukup <[email-masked]> writes:

    Martin> RADIUS "Access-Accept" indicates a successful
    Martin> authenthentication response for a user.

    Martin> The Access-Accept already returns a "Session-Timeout",
    Martin> defined as "Sets the maximum number of seconds of service
    Martin> to be provided to the user before the session
    Martin> terminates. This attribute value becomes the per-user
    Martin> "absolute timeout."".

This only tells the SNMP engine talking to the RADIUS server the
timeout.  You need to tell the other side of the exchange the timeout
too.

Remember that RADIUS is a callout service; it is not a trusted third
party.  In other words, in a particular SNMP authentication, only one
of the parties will know that RADIUS is being used.