Subject: [Netconf] server-model #27

From: Kent Watsen <[email-masked]>
Date: Wed, 14 Jan 2015 17:53:23 +0000

In last week's meeting we discussed adding to the YANG module for RESTCONF servers (ietf-restconf-server) an ability to authenticate RESTCONF clients using client certificates.

To be clear, while the RESTCONF server MUST use TLS (HTTPS), the client MAY authenticate using any of the mechanisms supported by the server (Basic, Digest, ClientCertificate, etc.).   Just like with NETCONF/SSH, for the Basic/Digest auth mechanisms, it is assumed that the server has some external database of users and passwords.   Similarly, as with NETCONF/TLS, it is assumed that the model must provide specific configuration for authenticating client certs and mapping a client cert to a username.  This is what issue #27 is about.

The current plan is to use the proposal described in https://github.com/netconf-wg/server-model/issues/27.   This proposal will be implemented if no objections are raised this week.

Thanks,
Kent