Subject: RE: [Isms] Re: securityName/groupName

From: "Nelson, David" <[email-masked]>
Date: Wed, 24 Aug 2005 17:04:09 -0400

Sam Hartman writes...

> Like including it in an integrity protected message indicating
> successful completion of authorization?

Maybe.  Does the above-described message indicate the identity of the
grantee?  If not, how does the relying party know which grantee this
authorization applies to?  Is this simply based on some session context?

In the PAM models, I rather suspect that there is some implementation
dependent session context that provides the desired binding of
authorization to grantee identity.  It may also be assumed that the
username (or other formal "name") of the grantee is unique within the
administrative scope of the grantor.  In that case, it may be sufficient
for the authorization message to simply contain that username.  I have
vague concerns that this scheme leaves some potential windows for an
attack, but I will need to think about the trust model and the details
of this kind of separation of authentication and authorization for a
while longer.

All of this is well and good, in theory, and as applied to some
authentication frameworks, e.g. PAM.  I'm not sure that it helps us
integrate with other AAA systems such as RADIUS and Diameter, however.

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: Sam Hartman <[email-masked]>
Date: Wed, 24 Aug 2005 17:08:08 -0400

>>>>> "Nelson," == Nelson, David <[email-masked]> writes:

    Nelson,> Sam Hartman writes...
    >> successful completion of authorization?

    Nelson,> Maybe.  Does the above-described message indicate the
    Nelson,> identity of the grantee?  
Yes.

    Nelson,> In the PAM models, I rather suspect that there is some
    Nelson,> implementation dependent session context that provides
    Nelson,> the desired binding of authorization to grantee identity.
There is not.

    Nelson,> It may also be assumed that the username (or other formal
    Nelson,> "name") of the grantee is unique within the
    Nelson,> administrative scope of the grantor.  

Or at least there is a unique identity to be authorized and
authorization takes place in terms of that identity.

In that case, it
    Nelson,> may be sufficient for the authorization message to simply
    Nelson,> contain that username.  I have vague concerns that this
    Nelson,> scheme leaves some potential windows for an attack, but I
    Nelson,> will need to think about the trust model and the details
    Nelson,> of this kind of separation of authentication and
    Nelson,> authorization for a while longer.

Sure.  Also, note that I'm just trying to understand the problem, not
to propose any change to RADIUS.