Subject: [AAA-WG]: multiple server uris?

From: Johan Johansson <[email-masked]>
Date: Fri, 23 Nov 2001 16:54:30 +0100

All,

it seems that some people - not on this list to the best of my knowledge 
though - argue that within an organization you do not want TLS due to 
administrative issues and that you therefore at the edges will need to 
be able to support both TLS and non-TLS connections. This among other 
things mean that this server will have multiple uris and that depending 
on the destination different uris must be put in the Origin-Host AVP.

I think this is A Bad Idea[TM], but more importantly, are there any 
basic assumptions in the protocol that would break?

j

---

From: Pat Calhoun <[email-masked]>
Date: Sun, 25 Nov 2001 08:56:35 -0800

This certainly does sound like a potential security problem. All one
now needs to do is impersonate an Origin-Host, and data will flow in
the clear.

PatC

---

From: Johan Johansson <[email-masked]>
Date: Mon, 26 Nov 2001 17:12:36 +0100

Well... it would seem that using firewalls and proper configuration most 
apparent security issues can be solved. The need arises in the first 
place because it doesn't seem to be possible to mix TLS and non-TLS, 
which could still use Ip Sec though, in the same net without at least 
one node announcing separate URIs.

j

---

From: Pat Calhoun <[email-masked]>
Date: Mon, 26 Nov 2001 08:20:11 -0800

fine, but when doing so, a Diameter node advertises a different URI on each
interface. I consider this an implementation issue, with no need for standardization.

PatC