Subject: Re: [Netconf] NACM work and motivation/contributions.

From: "Andy Bierman" <[email-masked]>
Date: Wed, 01 Sep 2010 09:52:35 -0700

I will post an update this week.
IMO, we should remove the AAA stuff rather than spend lots of time on optional standards, or make it mandatory. 

Andy

----- Reply message -----
From: "Bert (IETF) Wijnen" <[email-masked]>
Date: Wed, Sep 1, 2010 05:27
Subject: NACM work and motivation/contributions.
To: "Andy Bierman" <[email-masked]>, "Mark Scott" <[email-masked]>, "Martin Bjorklund" <[email-masked]>, "[email-masked]" <[email-masked]>

 On 8/28/10 12:13 AM, Juergen Schoenwaelder wrote:
> On Fri, Aug 27, 2010 at 10:35:33PM +0200, Andy Bierman wrote:
>
>> The rant is not directed at you or your charter text.
>> Are you offering to write a draft or provide text for NACM?
>> Does the WG even agree to these new requirements?
> I have been trying to be constructive but I obviously failed
> badly. And in case you forgot, the chairs have the task to
> determine concensus in the IETF.
>
> /js (who prefers to go to sleep instead of continuing this thread)
>
Mmm... too bad that sometimes we get upset (although I also often
understand how/why this can happen).

I'd say, we have our charter approved so let us start working.

We had agreed to not do a separate requirements document, but to include
a list of things we want to address (requirements) now (or possibly later
in a revision or via extensions) in the NACM document.

I think everyone can contribute to that and submit text for inclusion.

Andy, can you submit a first WG 00 version so people can see where
we are (I guess you can take into account some of our discussions in
Maastricht already) and then people can propose text for changes and additions
or deletions.

Hope this helps and gets us motivated (again) to work together.

Let go for it.
Bert

---

From: Martin Bjorklund <[email-masked]>
Date: Thu, 02 Sep 2010 08:47:37 +0200 (CEST)

> standards, or make it mandatory.

Well, access control _is_ AAA... (I'm sure people use the term in
different ways, but fwiw, this interpretation is at least backed by
wikipedia).

I think you mean that we should remove the possibility to configure
authentication mechanisms.  The current doc describes two mechanisms,
local users and radius, and is flexible enough to support others.  I
would prefer to keep these, but if we remove them, we should at least
describe how our authorization mechanism works with different
authentication schemes.  (For example, how the radius
Management-Policy-Id attribute is used to map to groups).

Maybe the best way forward is to publish what we have as -00, and then
start a discussion on what to remove / redesign.

/martin

---

From: Andy Bierman <[email-masked]>
Date: Thu, 02 Sep 2010 06:43:31 -0700

> start a discussion on what to remove / redesign.

I do not object to having the authentication mechanisms.
This rant is not specific to any one data model.

I guess I will let this drop, but it should be extremely obvious that
the flexibility of 'optional-to-implement', which looks so appealing to a server
developer, looks like a waste of time to an NMS developer.  Optional means
they will need to find another way to get 'job X' done, since they can't count
on the optional one.  Since they have to support that other data model, what is their
motivation to rewrite that code to use the optional data model instead?

I suppose we could put YANG feature conformance into description-stmts.
(e.g., -- if radius is on the system, then that feature in NACM MUST be implemented.)

Andy