Subject: Re: [Netconf] RFC5539bis Issues to decide in IETF 91

From: "Liubing (Leo)" <[email-masked]>
Date: Thu, 6 Nov 2014 02:56:57 +0000

Hi Dear all,

Please see replies inline.

From: Netconf [mailto:[email-masked]] On Behalf Of Ersue, Mehmet (NSN - DE/Munich)
Sent: Wednesday, October 29, 2014 8:55 PM
To: netconf
Subject: [Netconf] RFC5539bis Issues to decide in IETF 91

Dear NETCONF WG,

unfortunately the authors of the rfc5539bis draft will not be in IETF 91 meeting.
Below are two issues Juergen and the co-chairs would like to clarify.

As a preparation for the IETF 91 meeting please answer the questions below by November 8, 2014 EOB PT.
The co-chairs will lead to a conclusion and finalize the decision taking in IETF 91 NETCONF session.

Especially, please state for a) and b) separately, which options you prefer and why.
I.e. add your motivation/reasoning for your choices/answers.

a) Should the document become "NC over TLS with mutual X.509
   authentication" and hence a different auth scheme requires another
   "NC over TLS with FOOBAR authentication" document or should the
   document be NC over TLS and we find some other way to say "if you
   do X.509 mutual authentication, then you have to do what is defined
   here; other forms of authentication may be defined in future
   documents".
[Bing] We don't have a strong feeling on this issue.
Ideally, we think it's good to have a generic authentication mechanism defined in this document, but maybe it's unrealistic, so it's ok to explicitly limit the draft to X.509.

b) Should RFC 5539bis detail the algorithm how to extract a username
   from a certificate and then the server config model refers to that
   algorithm (this allows someone to implement RFC 5539bis without
   having to have the server config model implemented) or shall we
   leave the way a username is extract to the server config model
   document.
[Bing] We tend to include it in 5539bis. This make 5539bis itself complete. And it's more clear to explain the algorithm in the 5539bis context.

Regards,
Mehmet and Bert

---

From: t.petch <[email-masked]>
Date: Thu, 6 Nov 2014 10:09:20 +0000

----- Original Message -----
From: "Ersue, Mehmet (NSN - DE/Munich)" <[email-masked]>
To: "netconf" <[email-masked]>
Sent: Wednesday, October 29, 2014 12:55 PM

<snip>

<tp>

Re-reading this as people reply to it, I think the logic is false.

Putting the algorithm into netconf-server in no way requires people to
implement the whole of netconf-server.  It only requires them to go off
and read netconf-server in order to write the code that presents an
interface to the Internet that will interwork with other boxes.  Our RFC
often contain words to the effect that here is how to do it but there is
no need whatsoever to do it this way as long as the implementation
presents the same appearance to the outside world.  That is, we define
protocols, whether you can peer inside a box and see a perfect replica
of a data structure that appears in an RFC is irrelevant (ever seen an
RMON MIB Module?).

So there is a point to resolve, whether 5539bis is complete in itself
and so will get updated or contradicted by other I-D as time goes by, or
we take the relational database approach and put information in just the
one place and have others link to it.  I have been a fan of relational
databases for about 40 years now.

Tom Petch

Regards,
Mehmet and Bert

------------------------------------------------------------------------
--------

> _______________________________________________
> Netconf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/netconf
>