Subject: Re: [Netconf] FW: DISCUSS: netconf charter

From: "Andy Bierman" <[email-masked]>
Date: Wed, 25 Aug 2010 09:26:20 -0700

I agree with Juergen about s/particular/authenticated.

We are not adding new auth mechanisms.  We already have some text about deriving a user identity.
Other than that, we should keep the scope limited.

Andy

----- Reply message -----
From: "Romascanu, Dan (Dan)" <[email-masked]>
Date: Wed, Aug 25, 2010 09:14
Subject: [Netconf] FW: DISCUSS: netconf charter
To: "Juergen Schoenwaelder" <[email-masked]>, "Ersue, Mehmet (NSN - DE/Munich)" <[email-masked]>
Cc: "netconf" <[email-masked]>

> -----Original Message-----
> From: Juergen Schoenwaelder 
> [mailto:[email-masked]] 
> Sent: Wednesday, August 25, 2010 7:02 PM
> To: Ersue, Mehmet (NSN - DE/Munich)
> Cc: Romascanu, Dan (Dan); netconf; ext Bert Wijnen (IETF)
> Subject: Re: [Netconf] FW: DISCUSS: netconf charter
> 
> On Wed, Aug 25, 2010 at 05:32:29PM +0200, Ersue, Mehmet (NSN 
> - DE/Munich) wrote:
> > Hi All,
> > 
> > nice to hear that the group is working even when the chairs are on 
> > vacation ;)
> > 
> > I would like to propose to change the first paragraph in 
> point 3 (or 
> > any modified version which Russ is willing to accept) 
> Netconf Access 
> > Control Model (NACM) Requirements and Solution.
> > 
> > OLD:
> >       There is a need for standard mechanisms to restrict
> >       NETCONF protocol access for particular users to a pre-
> >       configured (by operator) subset of all available NETCONF
> >       operations and content.
> > 
> > NEW:
> >       There is a need for standard mechanisms to restrict
> >       NETCONF protocol access for authenticated users to a pre-
> >       configured (by operator) subset of all available NETCONF
> >       operations and content. For this purpose authentication 
> >       methods for use with the NETCONF protocol will be specified 
> >       to work hand-in-hand with the identity-based access control 
> >       mechanism.
> 
> So what is this "identity-based" access control thing then? 
> And as far as I understand, we are rechartering to do access 
> control work, not authentication work. I guess I do not 
> understand why the second sentence is useful.
> 
> /js
> 

My understanding is that if the network has a mechanism to authenticate
users access, the access mechanisms protocols to be defined here will
need to work 'hand-in-hand' with it. 

Dan
_______________________________________________
Netconf mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/netconf