Subject: [netconf] HTTP Configured Subscriptions questions – receiver identity and publisher ID

From: Declan Lydon <[email-masked]>
Date: Wed, 22 Apr 2020 10:21:51 +0000

Hi

We have looked at the latest draft describing a solution for HTTPS configured subscriptions (https://tools.ietf.org/html/draft-ietf-netconf-https-notif-02 ) and have a few questions:
	To derive the receiver identity, the proposed YANG module currently includes a cert-to-name map in the receiver-identity container.
		Is this the expected solution or are there other options still being discussed?
		There also seems to be an error in the cert-maps description, since it states that it would be the HTTP server that would use this cert-map, but it is configured on the publisher side (which is HTTP client).
	When notifications are sent over HTTPS, multiple publishers could sent notifications to the same receiver.
		Have there been any discussions on how to indicate the publisher in HTTPS, e g some additional ID?

Regards
Declan and Balázs

---

From: Kent Watsen <[email-masked]>
Date: Thu, 23 Apr 2020 16:08:44 +0000

Hi Declan,

> 		Is this the expected solution or are there other options still being discussed?

It is a work-in-progress that has yet to go to Last Call.  As such, things are still fluid.

> 		There also seems to be an error in the cert-maps description, since it states that it would be the HTTP server that would use this cert-map, but it is configured on the publisher side (which is H…

Agreed.  This is likely a copy/paste error.

> 	When notifications are sent over HTTPS, multiple publishers could sent notifications to the same receiver.

Correct.

> 		Have there been any discussions on how to indicate the publisher in HTTPS, e g some additional ID?

Each publisher authenticates itself to the receiver at the TLS and/or HTTP layers (see "client-identity”).

> Declan and Balázs

Kent // as co-author