Subject: RE: [Isms] Re: securityName/groupName

From: "David B Harrington" <[email-masked]>
Date: Tue, 23 Aug 2005 15:07:20 -0400

Hi,

Somebody privately questioned my assertion about RADIUS binding authn
and authz: 

> Recognize that with a AAA architecture like that used for
> RADIUS, that the authentication and authorization features
> are bound together, deliberately for security-binding
> reasons. 

If it is possible to authenticate the user within the security model,
and wait until the access control model to get the authorizations,
that could greatly alleviate my concerns about muddying the
architectural waters.

Is it possible to get a RADIUS authorization only, without an
authentication?
If so, can somebody explain the RADIUS messages and attributes
involved in doing this?

Thanks,
David Harrington
[email-masked]

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: Kaushik Narayan <[email-masked]>
Date: Tue, 23 Aug 2005 12:16:36 -0700

>If so, can somebody explain the RADIUS messages and attributes

I don't think so that is possible since authorization information is
passed backed to the NAS in a Access_Accept (there isn't a
separate RADIUS packet type for authorization requests).

This one of big differences between RADIUS and TACACS+,
TACACS+ does have a separate packet type for authorization
and allows authorization only requests.

regards,
  kaushik!