Subject: RE: [Isms] securityName

From: "Salowey, Joe" <[email-masked]>
Date: Mon, 25 Jul 2005 11:33:19 -0700

> I think the securityName comes from the authentication 
> protocol which usually in my environment authenticates a user 
> identity. Yes, this requires to have different ssh 
> connections if different identities access a device. But I 
> think this is also how you get into most CLIs as a different user.
>  

[Joe] There is typically be a mapping function between the securityName
and an authenticated identity.  This mapping could be from one
authenticated identity to many securityNames, however the mapping needs
to be authorized in order for this to be secure.  The securityName may
be implicitly derived (such as equivalent to the authenticated name or
some well defined porcessing of the authenticated name) or it can be
explicitly defined in an SNMP PDU or as a SASL authorization ID.  The
authorized mapping rules between authenticated identity and security
name can be maintained locally or remotely.  

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Mon, 25 Jul 2005 21:26:57 +0200

On Mon, Jul 25, 2005 at 11:33:19AM -0700, Salowey, Joe wrote:
> explicitly defined in an SNMP PDU or as a SASL authorization ID.  

In the USM case, there is the usmUserName (which is the USM specific
identity) which makes to the securityName (which is the security model
agnostic identity). In this particular case, the default mapping is a
one-to-one transformation. I am less sure whether N:1 or 1:M mappings
are feasible or desirable.

> The authorized mapping rules between authenticated identity and security

What do you mean when you say "remotely"?

/js

-- 
Juergen Schoenwaelder		    International University Bremen
<http://www.eecs.iu-bremen.de/>	    P.O. Box 750 561, 28725 Bremen, Germany

---

From: "David B Harrington" <[email-masked]>
Date: Mon, 25 Jul 2005 16:00:47 -0400

Hi Joe,

The SNMPv3/USM design foresaw the need for mappings from multiple
model-dependent identities (e.g. USM and Community models) to a
model-independent identity, so the same user utilizing different
securityModels could be mapped to one securityName, for expected use
by the access control subsystem. This is identified by the tuple {
securityModel, securityName }.

Under what circumstances do you envision needing the ability to map
from one model-specific identity to multiple securityNames, and how
would you know which mapping applied?

David Harrington
[email-masked]

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Salowey, Joe
> Sent: Monday, July 25, 2005 2:33 PM
> To: [email-masked]; Tom Petch
> Cc: [email-masked]
> Subject: RE: [Isms] securityName
> 
>  
> 
The