Subject: [Isms] securityName/groupname

From: "David B Harrington" <[email-masked]>
Date: Sun, 21 Aug 2005 17:16:13 -0400

Hi,

Here's what I'm hearing (and have heard in the past):

1) we have an authentication subsystem that yields a securityName.
2) we have access control currently based on group-based policies.
3) not everybody believes policies should be based on groups
4) often groups are defined to match organizational roles, but not
always
5) we need a binding between the securityName and the access control
policies
6) this binding should be done inside/outside the access control
subsystem
7) this binding should be done inside/outside the authentication
subsystem

I see three aspects:
1) principal authentication
2) access control policies
3) authorization of a principal to operate within a given policy.

This is similar to the RADIUS Filter-ID mechanism, where "named"
filters (policies) already exist on the access device, and RADIUS
authenticates the principal and identifies the filters (policies) that
should be applied to the principal's traffic. The proposal in the
RADEXT WG for management policies was designed to directly apply to
the problem we are trying to resolve.

So, let's 
1) make the access control subsystem the place where filters (views)
are pre-defined and named,
2) make the security model responsible for authenticating the
principal, and
3) make the security model responsible for identifying the named
filters to be applied. The USM security model already has two boxes
for "mechanisms" for authentication and privacy; let's add a third
"mechanism" for authorization.
4) let's add a parameter to the SNMPv3 ASIs for an accessFilterList,
which in a standardized format contains a human-readable list of
policy filters to be applied for that
securityname/securityModel/securityLevel.

This approach appends a new parameter, accessFilterList, to the ASIs,
to be used with securityModel, securityName, and securityLevel for
access control.

Does this sound reasonable?

David Harrington
[email-masked]

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms