Subject: Re: [Netconf] RFC5539bis Issues to decide in IETF 91

From: Kent Watsen <[email-masked]>
Date: Fri, 7 Nov 2014 13:32:08 +0000

I said all this before, but am replying again now to ensure it's in this thread as well.

(a) yes, it reflects what 5539 was before, or at least I think it intended to be, and it seems helpful to provide that clarity.   Looking at it from another angle, if we extend the scope to non-X.509 mechanisms, it would be hard support on the server-model draft, which I'm very much hoping to wrap up in the near term.

(b) I'm a proponent for RFC5539bis being self-contained in describing what is required.  If it requires client-certificate based auth, then it should say so (it doesn't currently).  To the specific question regarding extracting a username from a client cert, I think the question is, is it something that is specific to 5539bis or a data-model?  - stated another way, is there an expectation that client-certificates work across NETCONF servers, regardless which config model is used?  I know that it's been mentioned that the reference to the server-model doesn't mean the server-model has to be implemented, but to me there potential for confusion.  Lastly, I don't foresee this creating overlap as, if 5539bis had these requirements explained, the server-model would remove that text, referencing the 5539bis section(s) instead.  Putting this into perspective, I don't think we're talking about a lot of text that would need to go into 5539bis, just enough to declare *what* needs to be supported, and then let server-model describe *how* it is supported.

Thanks,
Kent

From: <Ersue>, "Mehmet (NSN - DE/Munich)" <[email-masked]<mailto:[email-masked]>>
Date: Wednesday, October 29, 2014 at 7:55 AM
To: NetConf <[email-masked]<mailto:[email-masked]>>
Subject: [Netconf] RFC5539bis Issues to decide in IETF 91

Dear NETCONF WG,

unfortunately the authors of the rfc5539bis draft will not be in IETF 91 meeting.
Below are two issues Juergen and the co-chairs would like to clarify.

As a preparation for the IETF 91 meeting please answer the questions below by November 8, 2014 EOB PT.
The co-chairs will lead to a conclusion and finalize the decision taking in IETF 91 NETCONF session.

Especially, please state for a) and b) separately, which options you prefer and why.
I.e. add your motivation/reasoning for your choices/answers.

a) Should the document become "NC over TLS with mutual X.509
   authentication" and hence a different auth scheme requires another
   "NC over TLS with FOOBAR authentication" document or should the
   document be NC over TLS and we find some other way to say "if you
   do X.509 mutual authentication, then you have to do what is defined
   here; other forms of authentication may be defined in future
   documents".

b) Should RFC 5539bis detail the algorithm how to extract a username
   from a certificate and then the server config model refers to that
   algorithm (this allows someone to implement RFC 5539bis without
   having to have the server config model implemented) or shall we
   leave the way a username is extract to the server config model
   document.

Regards,
Mehmet and Bert