Subject: [Netconf] RFC5539bis Issues to decide in IETF 91

From: "Ersue, Mehmet (NSN - DE/Munich)" <[email-masked]>
Date: Wed, 29 Oct 2014 12:55:17 +0000

Dear NETCONF WG,

unfortunately the authors of the rfc5539bis draft will not be in IETF 91 meeting.
Below are two issues Juergen and the co-chairs would like to clarify.

As a preparation for the IETF 91 meeting please answer the questions below by November 8, 2014 EOB PT.
The co-chairs will lead to a conclusion and finalize the decision taking in IETF 91 NETCONF session.

Especially, please state for a) and b) separately, which options you prefer and why.
I.e. add your motivation/reasoning for your choices/answers.

a) Should the document become "NC over TLS with mutual X.509
   authentication" and hence a different auth scheme requires another
   "NC over TLS with FOOBAR authentication" document or should the
   document be NC over TLS and we find some other way to say "if you
   do X.509 mutual authentication, then you have to do what is defined
   here; other forms of authentication may be defined in future
   documents".

b) Should RFC 5539bis detail the algorithm how to extract a username
   from a certificate and then the server config model refers to that
   algorithm (this allows someone to implement RFC 5539bis without
   having to have the server config model implemented) or shall we
   leave the way a username is extract to the server config model
   document.

Regards,
Mehmet and Bert

---

From: Qin Wu <[email-masked]>
Date: Fri, 31 Oct 2014 03:58:13 +0000

发件人: Netconf [mailto:[email-masked]] 代表 Ersue, Mehmet (NSN - DE/Munich)
发送时间: 2014年10月29日 20:55
收件人: netconf
主题: [Netconf] RFC5539bis Issues to decide in IETF 91

Dear NETCONF WG,

[Qin]: It doesn’t make sense, in my opinion, to create a new document each time when a new auth scheme comes up.
Having RFC5539bis as a comprehensive document seems more reasonable choice. Also mutual X.509 authentication is just a optional
feature supported by NC over TLS.

[Qin]: I favor removing cross reference between RFC5539bis and draft-ietf-netconf-server-model-04.
Specifying the algorithm on how to extract a username from a certificate within RFC5539bis more makes sense to me.

Regards,
Mehmet and Bert

---

From: "Bajpai, Vaibhav" <[email-masked]>
Date: Fri, 31 Oct 2014 10:51:43 +0000

> On 31 Oct 2014, at 04:58, Qin Wu <[email-masked]> wrote:

[...]

> Having RFC5539bis as a comprehensive document seems more reasonable choice.

Ideally yes, but in practise it would be much easier to develop 
consensus with separate documents that have a crispier scope.

Best, Vaibhav

=====================================================
Vaibhav Bajpai

Research I, Room 91
Computer Networks and Distributed Systems  (CNDS) Lab
School of Engineering and Sciences
Jacobs University Bremen, Germany

www.vaibhavbajpai.com
=====================================================