Subject: RE: [Isms] securityName

From: "Blumenthal, Uri" <[email-masked]>
Date: Mon, 25 Jul 2005 15:34:42 -0400

For several reasons, it makes sense to make Security Model responsible
for providing the mapping between SNMP-specific securityName that
appears in at least in two components (Access Control Model and Security
Model), and security model-specific way to identify the authenticated
principal (user@realm, PK OID, hash(fingerprint), whatever).  For
example, other components may not know the identity that newSM used to
perform principal authentication.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Juergen Schoenwaelder
Sent: Monday, July 25, 2005 3:27 PM
To: Salowey, Joe
Cc: [email-masked]
Subject: Re: [Isms] securityName

On Mon, Jul 25, 2005 at 11:33:19AM -0700, Salowey, Joe wrote:
>  
> 
> > I think the securityName comes from the authentication 
> > protocol which usually in my environment authenticates a user 
> > identity. Yes, this requires to have different ssh 
> > connections if different identities access a device. But I 
> > think this is also how you get into most CLIs as a different user.
> >  
> 
> [Joe] There is typically be a mapping function between the
securityName
> and an authenticated identity.  This mapping could be from one
> authenticated identity to many securityNames, however the mapping
needs
> to be authorized in order for this to be secure.  The securityName may
> be implicitly derived (such as equivalent to the authenticated name or
> some well defined porcessing of the authenticated name) or it can be
> explicitly defined in an SNMP PDU or as a SASL authorization ID.  

In the USM case, there is the usmUserName (which is the USM specific
identity) which makes to the securityName (which is the security model
agnostic identity). In this particular case, the default mapping is a
one-to-one transformation. I am less sure whether N:1 or 1:M mappings
are feasible or desirable.

> The authorized mapping rules between authenticated identity and
security
> name can be maintained locally or remotely.

What do you mean when you say "remotely"?

/js

-- 
Juergen Schoenwaelder		    International University Bremen
<http://www.eecs.iu-bremen.de/>	    P.O. Box 750 561, 28725 Bremen,
Germany

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: "David B Harrington" <[email-masked]>
Date: Mon, 25 Jul 2005 16:01:25 -0400

Hi Uri,

Were you answering a question? If so, which question? I'm not sure
where your comment fits into the discussion and want to understand the
context of your comment. Is this in response to the local versus
remote comment by Joe?

David Harrington
[email-masked]

> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Blumenthal, Uri
> Sent: Monday, July 25, 2005 3:35 PM
> To: [email-masked]
> Subject: RE: [Isms] securityName
>