From: "Bernard Aboba" <bernard_aboba@hotmail.com>
To: Black_David@emc.com
Cc: ips@ece.cmu.edu
Subject: RE: iSCSI User Auth MIB - security issue
Date: Thu, 26 Jun 2003 04:25:48 -0700
Mime-Version: 1.0
Content-Type: text/plain; format=flowed
Message-ID: <BAY7-F1124nagamhpPQ000243fc@hotmail.com>
Sender: owner-ips@ece.cmu.edu
Precedence: bulk

>So, in the RADIUS case, the MIB as-is functions only to do
>authorization (i.e., which identities using what authentication
>methods have access to which targets) in combination with the main
>iSCSI MIB.

The RADIUS access decision involves not only checking the credentials, but 
also validating the authorizations as well. So it seems that the 
authorizations  also potentially reside on the RADIUS server.

I think this means that there needs to be a statement about which 
authorizations take precedence.

In some cases there can be a mix of local and remote authentication -- a 
target can have local users and authentication methods and if the identity 
or authentication method is not one of those, then the authentication is 
remoted.  I think this implies that RADIUS will take precedence for 
authorization of a remote user, but that local authorizations are used for 
local users.

_________________________________________________________________
The new MSN 8: advanced junk mail protection and 2 months FREE*  
http://join.msn.com/?page=features/junkmail