Subject: RE: [Isms] FW: RADIUS integration

From: "Nelson, David" <[email-masked]>
Date: Mon, 26 Jun 2006 18:00:53 -0400

Jeffrey Hutzelman writes...
 
> And that model is no longer sufficient.

Well, I certainly see the limitations.  Of course, RADIUS is a legacy
protocol and the reason we're addressing it in ISMS is because of its
wide deployment.

> Authentication and authorization _are_ separate concepts, 
> and people are beginning to recognize that and treat them
> separately.

Sure.  The only question is what it would take to perform that
"separation" in RADIUS.  We've had an initial discussion of this issue
on the RADEXT list, that resulted in some push-back.  We will continue
that discussion both on the list and at IETF-66.

> But it can only be used that way if a RADIUS client can say 
> "this is the user's identity; tell me what I need to know to
> make an access decision".

Right.

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Mon, 26 Jun 2006 18:07:04 -0400

> that discussion both on the list and at IETF-66.

Well, I'm happy to show up on the mailing list and try to make the point 
(unfortunately, I can't come to the WG meeting at IETF-66, as I'm chairing 
another meeting that session).  I don't see this as an ISMS-specific 
feature; in fact, I'm much more likely to deploy it for other uses.

-- Jeff