Subject: RE: [Isms] FW: RADIUS integration

From: "Nelson, David" <[email-masked]>
Date: Tue, 27 Jun 2006 14:07:53 -0400

> The ISMS WG is supposed to prepare a request for RADEXT, explaining
> the requirements we would like to see addressesd, so this discussion
> may be in the right place.

A simple e-mail message from the ISMS chairs would suffice.  This
doesn't need to be an I-D.

Something like:

The ISMS WG has a requirement for its use of RADIUS as a centralized AAA
service to be used with SNMPv3 running over a protected transport,
specifically over SSH.  The requirement is for an "Authorize Only"
service in RADIUS, in which the NAS asserts the identity of a user,
previously authenticated to the NAS by some other authentication
service, such as Kerberos.  The RADIUS server is required to respond to
the NAS with the appropriate authorization and service provisioning
attributes for that user, including those specific to ISMS usages.

It is desired to leverage existing RADIUS deployments, and thus the ISMS
WG has a preference for RADIUS integration methods that require no
change to RADIUS server implementations, or at most the enrollment of
additional provisioning attributes in a data dictionary.  New RADIUS
operational modes that would require changes to existing RADIUS server
implementations are less desirable, but could be considered.

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Tue, 27 Jun 2006 18:11:24 -0400

> implementations are less desirable, but could be considered.

Except I don't think that's actually a requirement, and I do think it makes 
the solution considerably harder.  I don't consider it unreasonable for 
people wanting to use the authorize-only feature to have to upgrade their 
RADIUS servers to support a new authentication method.

I do think it is preferable for deployments not using the new feature not 
to require any changes to the RADIUS server code.