Subject: RE: [Isms] RE: Follow up on Authorize Only issue

From: "Glen Zorn \(gwz\)" <[email-masked]>
Date: Tue, 25 Jul 2006 21:33:56 -0700

Jeffrey Hutzelman <mailto:[email-masked]> supposedly scribbled:

> On Tuesday, July 25, 2006 02:16:41 PM -0700 "Glen Zorn (gwz)"
> <[email-masked]> wrote:
> 
>> Don't quite understand this either: if a server doesn't recognize the
>> postulated Asserted-Identity Attribute, it seems that as far as it is
>> concerned there will be no credential-bearing attribute in the
>> message. So just omitting any credential-bearing attribute (along
>> with the addition of the other stuff we've been talking about)
>> should get just the same response from a legacy server, right?
> 
>> From a _legacy_ server, yes.  The concern is about how this would
>> affect
> handling of some new authentication method invented in the future. 
> Suppose there is a new method that requires a "Frobozz" attribute,
> and we have a client that sends a request using that method.  A
> server which supports "Frobozz" will respond correctly, as will a
> server that does not support either "Frobozz" or authorize-only.    
> 
> 
> However, a server that supports authorize-only but does _not_ support
> "Frobozz" will believe the client intended authorize-only, and will
> return a successful response on that basis, without verifying the
> user's identity.   
> That's the situation which we need an "Asserted-Identity" attribute
> to avoid.  The _contents_ of such an attribute are irrelevant; the
> important thing is an affirmative indication that the client meant
> authorize-only and not some unknown "Frobozz".   

OK, one more time: that seems to be what a Service-Type of Authorize-Only would do....

> -- Jeff

Hope this helps,

~gwz

Why is it that most of the world's problems can't be solved by simply
  listening to John Coltrane? -- Henry Gabriel

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Wed, 26 Jul 2006 00:49:48 -0400

> OK, one more time: that seems to be what a Service-Type of Authorize-Only

[repeating text from a previous message]
Not if you want to use Service-Type to actually indicate the service type, 
instead of overloading it to mean something else.  As I understand it, this 
attribute is _supposed_ to indicate the type of service the NAS is 
providing to the user, and overloading it to mean something else was a 
mistake.  If this attribute is used for its intended purpose, to allow the 
RADIUS server to know what service to provision, then it cannot also be 
used to indicate authorize-only mode.

Otherwise, how is the RADIUS server supposed to know whether my terminal 
server is asking about providing a user with dialup network access or 
SNMPv3 access?  Some of my users are entitled to one but not the other.

-- Jeff