Subject: Re: [Last-Call] Yangdoctors last call review of draft-ietf-opsawg-tacacs-yang-03

From: "Wubo (lana)" <[email-masked]>
Date: Thu, 7 May 2020 08:08:08 +0000

Hi Lada, Joe,

Thanks for the guidance, please see inline.

Thanks,
Bo

-----邮件原件-----
发件人: Ladislav Lhotka [mailto:[email-masked]] 
发送时间: 2020年5月7日 14:38
收件人: Joe Clarke (jclarke) <[email-masked]>; Wubo (lana) <[email-masked]>
抄送: [email-masked]; [email-masked]; [email-masked]; [email-masked]
主题: Re: Yangdoctors last call review of draft-ietf-opsawg-tacacs-yang-03

"Joe Clarke (jclarke)" <[email-masked]> writes:

>> - Is it correct that the server type may be either one of "authentication", "authorization" or "accounting", or all of them? Is it impossible for a server to be authentication & authorization but not accounting? Such a variant cannot be configured.
>> [Bo] OK, will correct when the final guidance on this issue is received.
>
> Lada replied yesterday to say that the bit string is likely preferred similar to access-operations in ietf-netconf-acm.  I might personally discourage the use of ‘*’ for this given that there are only three types, but that’s just my individual thought.

+1

I think it is better to have all three types explicitly in the value. Perhaps this could also be the default?

Lada
[Bo] Please see if the definition below is correct:
  typedef tcsplus-server-type {
       type bits {
         bit authentication {
           description
             "When set, the server is an authentication server.";
         }
         bit authorization {
           description
             "When set, the server is an authorization server.";
         }
         bit accounting {
           description
             "When set, the server is an accounting server.";
         }
         bit all {
           description
             "When set, the server can be all types of TACACS+ servers.";
         }		 
		 
       }
       description
         "server-type can be set to authentication/authorization/accounting or any combination of the three types. 
          When all three types are supported, either "all" or the three bits setting can be used;
     }

> Joe

-- 
Ladislav Lhotka 
Head, CZ.NIC Labs
PGP Key ID: 0xB8F92B08A9F76C67

---

From: tom petch <[email-masked]>
Date: Thu, 7 May 2020 10:37:39 +0000

From: OPSAWG <[email-masked]> on behalf of Wubo (lana) <[email-masked]>
Sent: 07 May 2020 09:08

Hi Lada, Joe,

Thanks,
Bo

-----邮件原件-----
发件人: Ladislav Lhotka [mailto:[email-masked]]
发送时间: 2020年5月7日 14:38

+1

Lada

       }
       description

<tp>
I would drop the all.   I know that I suggested it, or an asterisk, but I was thinking that this was a common  case.  Joe suggests that no accounting is the commoner - I do not have sufficient exposure to know - in which case I would not bother with 'all'.  Whether or not to make auth/auth  the default I have no particular view on - as I say, I lack the exposure to be confident about that.

Having 'all' adds complexity, two ways to something, while making a small saving in message size - on balance, not worth it. 

Tom Petch 

--
Ladislav Lhotka
Head, CZ.NIC Labs
PGP Key ID: 0xB8F92B08A9F76C67
_______________________________________________
OPSAWG mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/opsawg

---

From: Ladislav Lhotka <[email-masked]>
Date: Thu, 7 May 2020 15:02:24 +0200

> Having 'all' adds complexity, two ways to something, while making a small saving in message size - on balance, not worth it.

Agreed. Lada

---

From: "Joe Clarke (jclarke)" <[email-masked]>
Date: Thu, 7 May 2020 13:38:51 +0000

>  typedef tcsplus-server-type {

Why not spell out tacacsplus?

>             "When set, the server can be all types of TACACS+ servers.";

As Lada and Tom have said, I wouldn’t do “all” here.  With only three options, having them be explicitly listed is a good thing IMHO.

Joe

---

From: john heasley <[email-masked]>
Date: Thu, 7 May 2020 18:10:20 +0000

> > Having 'all' adds complexity, two ways to something, while making a small saving in message size - on balance, not worth it.

Note that enabling certain types of accounting is rare, at least in my
opinion.  eg: enabling login accounting is not rare, while command
accounting is rare because it is expensive esp. on some particular devices.

Also, rare or not, enabling it for a tacacs server is sort of orthogonal.
it will not be used for that purpose unless some form of accounting is
enabled.

I'll have to look at the model again; i do not recall if the model allows
for particular accounting types w/o augmentation.