Subject: [Ideas] draft-padma-ideas-problem-statement and "Common Infrastructure"

From: Robert Moskowitz <[email-masked]>
Date: Wed, 5 Jul 2017 09:35:59 -0400

Disclaimer:  I had a hand in edits to this version, though I am not 
listed in the Ack section.  In particular I pushed for "Common 
Infrastructure", not "Common Control Plane".

We have been talking a lot about Identity and Identifier and metadata.  
One of the tasks of this workgroup (and charter item) needs to be data 
modeling of what is intended to be stored/available.

Further there needs to be Yet Another Gap Analysis (YAGA?  :) ) on why 
NOT LDAP or some other mature xyz data store access protocol.  I start 
with LDAP as there is actually a fit, and the various server 
implementations are very mature with good, secure, backends and data 
replication tools.

It is time to start thinking charter.  The problem statement, gap 
analysis, and use cases is barely a start.  What the group is going to 
DO is focus now.

So I propose two work items:

Common Infrastructure data modeling (and someone other than me can do it 
in YANG).
Common Infrastructure protocol requirements with a subsection on LDAP 
comparision.

Bob

---

From: Padma Pillay-Esnault <[email-masked]>
Date: Wed, 5 Jul 2017 07:02:47 -0700

Hi Bob

Sent from my iPhone

> On Jul 5, 2017, at 06:35, Robert Moskowitz <[email-masked]> wrote:
> 
> Disclaimer:  I had a hand in edits to this version, though I am not listed in the Ack section.  In particular I pushed for "Common Infrastructure", not "Common Control Plane".

See contributors section.
> 
> We have been talking a lot about Identity and Identifier and metadata.  One of the tasks of this workgroup (and charter item) needs to be data modeling of what is intended to be stored/available.
> 
Agree

> Further there needs to be Yet Another Gap Analysis (YAGA?  :) ) on why NOT LDAP or some other mature xyz data store access protocol.  I start with LDAP as there is actually a fit, and the various server implementations are very mature with good, secure, backends and data replication tools.
> 
> It is time to start thinking charter.  The problem statement, gap analysis, and use cases is barely a start.  What the group is going to DO is focus now.
> 
> Common Infrastructure data modeling (and someone other than me can do it in YANG).
> Common Infrastructure protocol requirements with a subsection on LDAP comparision.
> 
So we will need some volunteers to work on this

Padma
> Bob
> 
> 
> _______________________________________________
> Ideas mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ideas

---

From: tjw ietf <[email-masked]>
Date: Wed, 5 Jul 2017 10:05:30 -0400

Bob!

Brian and I had chatted briefly about charter direction and we wanted to
hear some of the discussions during the session. And that's what they pay
us the big bucks for!

But I have to agree with your plan of attack.  If we could give some
guidance:

- work on the problem statement and gap analysis but don't invest larger
cycles of time on them.

- requirements are good to capture, but we will shy away from turning them
into published documents as they will change over time

- some discussion on LDAP is very necessary as the code base has gotten
quite mature.

tim

On Wed, Jul 5, 2017 at 9:35 AM, Robert Moskowitz <[email-masked]>
wrote:

> Disclaimer:  I had a hand in edits to this version, though I am not listed
> in the Ack section.  In particular I pushed for "Common Infrastructure",
> not "Common Control Plane".
>
>
> Further there needs to be Yet Another Gap Analysis (YAGA?  :) ) on why NOT
> LDAP or some other mature xyz data store access protocol.  I start with
> LDAP as there is actually a fit, and the various server implementations are
> very mature with good, secure, backends and data replication tools.
>
> analysis, and use cases is barely a start.  What the group is going to DO
> is focus now.
>

---

From: Robert Moskowitz <[email-masked]>
Date: Wed, 5 Jul 2017 10:16:06 -0400

Tim,

Well it seems I got an upgrade to contributing to the problem 
statement.  I missed that in the last go around hours before the draft 
cutoff.  Thanks Padma.

I said 'requirements' to soften the blow, so to speak, about 'why NOT 
LDAP'.  Plus the data model to see if it can fit into an LDAP schema.

Of course we could always go with DAP instead for richer policy control 
and distributed data support!  (was it actually 20 years ago that I 
worked on this stuff? yikes!)

Bob

On 07/05/2017 10:05 AM, tjw ietf wrote:
> Bob!
>
> Brian and I had chatted briefly about charter direction and we wanted 
> to hear some of the discussions during the session. And that's what 
> they pay us the big bucks for!
>
> - work on the problem statement and gap analysis but don't invest 
> larger cycles of time on them.
>
> - requirements are good to capture, but we will shy away from turning 
> them into published documents as they will change over time
>
> - some discussion on LDAP is very necessary as the code base has 
> gotten quite mature.
>
> tim
>
> On Wed, Jul 5, 2017 at 9:35 AM, Robert Moskowitz 
> <[email-masked] <mailto:[email-masked]>> wrote:
>
>     We have been talking a lot about Identity and Identifier and
>     metadata.  One of the tasks of this workgroup (and charter item)
>     needs to be data modeling of what is intended to be stored/available.
>
>     Further there needs to be Yet Another Gap Analysis (YAGA? :) ) on
>     why NOT LDAP or some other mature xyz data store access protocol. 
>     I start with LDAP as there is actually a fit, and the various
>     server implementations are very mature with good, secure, backends
>     and data replication tools.
>
>     analysis, and use cases is barely a start. What the group is going
>     to DO is focus now.
>
>     [email-masked] <mailto:[email-masked]>
>     <https://www.ietf.org/mailman/listinfo/ideas>
>
>
>
>

---

From: Uma Chunduri <[email-masked]>
Date: Wed, 5 Jul 2017 22:58:42 +0000

Hi Bob,

> I said 'requirements' to soften the blow, so to speak, about 'why NOT LDAP'.  Plus the data model to see if it can fit into an LDAP schema.
> Of course we could always go with DAP instead for richer policy control and distributed data support!

I am not sure if this would be LDAP or something else. I presume the context is entities authentication and subsequent operations to indicate policy. Is this correct?

If Yes, I have couple of thoughts:

1.       We ought to focus on category of entities (low power/regular nodes/routers) and see what suits best. Perhaps one of the EAP methods suitable to the environments (minimal RTTs, mutual authentication if needed in some cases)?

2.       Regarding policy - I see your point of "richer policy" but we may have to start with much more simpler policy (say white list/black list on Identifiers) as some of it has to be distributed/shared across without any privacy concerns

3.       Regarding distribution of public parts of policy and other information with Identifiers, we ought to see if we have to use any existing mapping servers (DDT, DHT, Blockchain or some simplified/selective pull based "new" protocol among each providers Identifiers).

May be we might have to discuss problems and requirements bit deeper to hash out the above.
--
Uma C.

From: Ideas [mailto:[email-masked]] On Behalf Of Robert Moskowitz
Sent: Wednesday, July 05, 2017 7:16 AM
To: tjw ietf <[email-masked]>
Cc: [email-masked]
Subject: Re: [Ideas] draft-padma-ideas-problem-statement and "Common Infrastructure"

Tim,

Well it seems I got an upgrade to contributing to the problem statement.  I missed that in the last go around hours before the draft cutoff.  Thanks Padma.

I said 'requirements' to soften the blow, so to speak, about 'why NOT LDAP'.  Plus the data model to see if it can fit into an LDAP schema.

Of course we could always go with DAP instead for richer policy control and distributed data support!  (was it actually 20 years ago that I worked on this stuff? yikes!)

Bob

Bob!

Brian and I had chatted briefly about charter direction and we wanted to hear some of the discussions during the session. And that's what they pay us the big bucks for!

But I have to agree with your plan of attack.  If we could give some guidance:

- work on the problem statement and gap analysis but don't invest larger cycles of time on them.

- requirements are good to capture, but we will shy away from turning them into published documents as they will change over time

- some discussion on LDAP is very necessary as the code base has gotten quite mature.

tim

On Wed, Jul 5, 2017 at 9:35 AM, Robert Moskowitz <[email-masked]<mailto:[email-masked]>> wrote:
Disclaimer:  I had a hand in edits to this version, though I am not listed in the Ack section.  In particular I pushed for "Common Infrastructure", not "Common Control Plane".

Bob

_______________________________________________
Ideas mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/ideas

Ideas mailing list

[email-masked]<mailto:[email-masked]>

---

From: Robert Moskowitz <[email-masked]>
Date: Wed, 5 Jul 2017 19:06:10 -0400

Uma,

In your list below, DHT is something (that is flat name space) that LDAP 
does poorly.  But LDAP IS a mapping system that has been around for lots 
of years.

And it has authentication in terms of who can add/update and who can 
inquire on what.

And EAP is NOT minimal RTT!  It is often yet another wrapper to have 
some common wrapper.  In this case, it would be PANA delivering EAP.  So 
we will discuss this all.

Bob

On 07/05/2017 06:58 PM, Uma Chunduri wrote:
> I am not sure if this would be LDAP or something else. I presume the 
> context is entities authentication and subsequent operations to 
> indicate policy. Is this correct?
>
> 1.We ought to focus on category of entities (low power/regular 
> nodes/routers) and see what suits best. Perhaps one of the EAP methods 
> suitable to the environments (minimal RTTs, mutual authentication if 
> needed in some cases)?
>
> 2.Regarding policy – I see your point of “richer policy” but we may 
> have to start with much more simpler policy (say white list/black list 
> on Identifiers) as some of it has to be distributed/shared across 
> without any privacy concerns
>
> 3.Regarding distribution of public parts of policy and other 
> information with Identifiers, we ought to see if we have to use any 
> existing mapping servers (DDT, DHT, Blockchain or some 
> simplified/selective pull based “new” protocol among each providers 
> Identifiers).
>
> *From:*Ideas [mailto:[email-masked]] *On Behalf Of *Robert 
> Moskowitz
> *Sent:* Wednesday, July 05, 2017 7:16 AM
> *To:* tjw ietf <[email-masked]>
> *Cc:* [email-masked]
> *Subject:* Re: [Ideas] draft-padma-ideas-problem-statement and "Common 
> Infrastructure"
>
> Tim,
>
> Of course we could always go with DAP instead for richer policy 
> control and distributed data support!  (was it actually 20 years ago 
> that I worked on this stuff? yikes!)
>
> Bob
>
>     Brian and I had chatted briefly about charter direction and we
>     wanted to hear some of the discussions during the session. And
>     that's what they pay us the big bucks for!
>
>     - requirements are good to capture, but we will shy away from
>     turning them into published documents as they will change over time
>
>         Disclaimer:  I had a hand in edits to this version, though I
>         am not listed in the Ack section.  In particular I pushed for
>         "Common Infrastructure", not "Common Control Plane".
>
>
>         metadata.  One of the tasks of this workgroup (and charter
>         item) needs to be data modeling of what is intended to be
>         stored/available.
>
>         Further there needs to be Yet Another Gap Analysis (YAGA?  :)
>         ) on why NOT LDAP or some other mature xyz data store access
>         protocol.  I start with LDAP as there is actually a fit, and
>         the various server implementations are very mature with good,
>         secure, backends and data replication tools.
>
>         It is time to start thinking charter.  The problem statement,
>         gap analysis, and use cases is barely a start.  What the group
>         is going to DO is focus now.
>

---

From: Uma Chunduri <[email-masked]>
Date: Wed, 5 Jul 2017 23:40:28 +0000

Bob,

In-line [Uma]:

--
Uma C.

From: Robert Moskowitz [mailto:[email-masked]]
Sent: Wednesday, July 05, 2017 4:06 PM
To: Uma Chunduri <[email-masked]>; tjw ietf <[email-masked]>
Cc: [email-masked]
Subject: Re: [Ideas] draft-padma-ideas-problem-statement and "Common Infrastructure"

Uma,

In your list below, DHT is something (that is flat name space) that LDAP does poorly.
[Uma]: Thx for clarifying that. But flat space or not is completely a different discussion.. (and has to be discussed too)
  But LDAP IS a mapping system that has been around for lots of years.
And it has authentication in terms of who can add/update and who can inquire on what.
And EAP is NOT minimal RTT!
[Uma]:  You are right of course. We may not need minimal RTT in some cases and mutual AUTH (can be debatable). I see,  40+ EAP methods give the spectrum of all choices.
It is often yet another wrapper to have some common wrapper.  In this case, it would be PANA delivering EAP.
[Uma]: Indeed, some lower layer is required to carry EAP. As PS talks about we need a private channel for AUTH and policy updates.
So we will discuss this all.
[Uma]: Yes, we need to discuss a bit on this.

Bob

From: Ideas [mailto:[email-masked]] On Behalf Of Robert Moskowitz
Sent: Wednesday, July 05, 2017 7:16 AM
To: tjw ietf <[email-masked]><mailto:[email-masked]>
Cc: [email-masked]<mailto:[email-masked]>
Subject: Re: [Ideas] draft-padma-ideas-problem-statement and "Common Infrastructure"

Tim,

Bob

Bob!

tim

Bob

Ideas mailing list

Ideas mailing list