Subject: RE: [Isms] Re: securityName/groupName

From: "Nelson, David" <[email-masked]>
Date: Tue, 23 Aug 2005 15:34:14 -0400

> Is it possible to get a RADIUS authorization only, without an
> authentication?

It is possible.  It didn't use to be, but with the introduction of
Dynamic RADIUS (RFC 3576) and the Service-Type of Authorize-Only it is
possible.  Dynamic RADIUS is primarily use for re-authorization of an
existing session, presumably one that was authenticated and authorized
to begin with.

While this is possible, I would not recommend it as the primary means of
integration of RADIUS into ISMS.  Using the initial binding of
authentication to authorization provided in the Access-Accept message is
the most straightforward approach.

BTW, the usage scenarios for Authorize-Only are have been the subject of
recent debate on the RADEXT WW mailing list, and the subject of a
discussion in RADEXT Issues and Fixes I-D.

This kind of separation of authentication and authorization only works
if RADIUS Server and Client share a well defined concept of an existing
session, and the strength of the resultant "binding", based on session
context is considered to be adequate for the application environment. 

> If so, can somebody explain the RADIUS messages and attributes
> involved in doing this?

Presumably one would perform an initial RADIUS authentication
(Access-Request, Access-Accept exchange).  The session could then be
re-authorized with some specific authorization information.  In the
Dynamic RADIUS scenario, it is typically the RADIUS Server that
initiates the revised authorization.  It may also be possible for the
RADIUS Client to initiate an Authorize-Only authentication request, but
this is currently subject to controversy in RADEXT.

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: Kaushik Narayan <[email-masked]>
Date: Tue, 23 Aug 2005 13:08:26 -0700

Hi Dave,

>existing session, presumably one that was authenticated and authorized

Isn't CoA primarily addressing the network access use case wherein
a session is established and re-authorization needs to happen because
of some policy change. I am not sure the ISMS use case has a similar
premise, wouldn't it be real stretch to extend CoA to ISMS.

regards,
  kaushik!

---

From: Sam Hartman <[email-masked]>
Date: Wed, 24 Aug 2005 13:48:51 -0400

>>>>> "Nelson," == Nelson, David <[email-masked]> writes:

    >> Is it possible to get a RADIUS authorization only, without an

    Nelson,> It is possible.  It didn't use to be, but with the
    Nelson,> introduction of Dynamic RADIUS (RFC 3576) and the
    Nelson,> Service-Type of Authorize-Only it is possible.  Dynamic
    Nelson,> RADIUS is primarily use for re-authorization of an
    Nelson,> existing session, presumably one that was authenticated
    Nelson,> and authorized to begin with.

    Nelson,> While this is possible, I would not recommend it as the
    Nelson,> primary means of integration of RADIUS into ISMS.  Using
    Nelson,> the initial binding of authentication to authorization
    Nelson,> provided in the Access-Accept message is the most
    Nelson,> straightforward approach.

How would you invision authentication methods like gssapi-with-mic or
publickey working if we don't separate authorization from
authentication?

I do agree that for the password based methods we don't want this separation.

---

From: Kaushik Narayan <[email-masked]>
Date: Wed, 24 Aug 2005 12:14:12 -0700

>I do agree that for the password based methods we don't want this separation.

I think the discussion was around separation of authentication and 
authorization
requests for RADIUS (which is largely password based).

---

From: Sam Hartman <[email-masked]>
Date: Wed, 24 Aug 2005 15:50:32 -0400

>>>>> "Kaushik" == Kaushik Narayan <[email-masked]> writes:

    >> How would you invision authentication methods like
    >> gssapi-with-mic or publickey working if we don't separate
    >> authorization from authentication?
    >> 
    >> 

    Kaushik> I think the discussion was around separation of
    Kaushik> authentication and authorization requests for RADIUS
    Kaushik> (which is largely password based).

Yes, but I think a lot of operators who do use things like Kerberos
may also use RADIUS for authorization.

---

From: Kaushik Narayan <[email-masked]>
Date: Wed, 24 Aug 2005 13:32:03 -0700

Hi Sam,

inline,

<snipped>

>may also use RADIUS for authorization.

I have my doubts about real life examples of this, I have seen RADIUS
and Kerberos used in conjunction but it has been more like a Kerberos
KDC serving as a backend authentication system for a RADIUS server.

regards,
   kaushik!