Subject: Re: WG Last Call: draft-ietf-pana-usage-scenarios-04.txt

From: Gopal Dommety <[email-masked]>
Date: Tue, 11 Mar 2003 17:13:02 -0800

Hello All:

I quickly went through the draft. My personal opinion is that it would be 
good to expand the scope to include Authorization (of services etc).

This draft seems to indicate that  PANA is a protocol for Authentication.
It is not clear to me where we stand on authorization. There have been 
occasional
references to authorization (that makes me think the authorization is in 
the scope). For example:

3.6. Limited Free Access

"Certain networks might allow clients to access a limited topology without 
any explicit authentication and authorization" and seems to indicate that 
pana will be used to do authorization.

3.2. PANA with Link-Layer Security

"But it (the existing gsm/cdma networks) does not necessarily provide 
authorization at the network- layer which can be done by authenticating the 
client to an ISP. So this still necessitates another layer of 
authentication. It should be noted that this second authentication takes 
place over a secure channel"

My personal opinion is that it would be good to expand the scope to include 
Authorization (of services etc).  Let me know if you need me to articulate 
it better or contribute.

Thanks
Gopal

---

From: Alper Yegin <[email-masked]>
Date: Wed, 12 Mar 2003 14:58:25 -0800

Hi Gopal,

Thank you for the review.

In the requirements draft, this is what we have:

   In addition to carrying authentication information, PANA MUST also
   provides only a binary authorization to indicate whether the PaC
   is allowed to access full IP services on the network. Providing
   finer granularity authorization, such as negotiating QoS parameters,
   authorizing individual services (http vs. ssh), individual users
   sharing the same device, etc. is outside the scope of PANA.

So, authentication and authorization goes hand-in-hand. Or, in other words,
the network is authenticating the client to authorizing it for network
access. 

We can make this more clear in the usage scenarios draft.

So far we have been keeping the scope limited to "network access service".
Do you mean PANA could be used as a generic service authorization protocol,
that can be used with anything?

alper

---

From: Gopal Dommety <[email-masked]>
Date: Thu, 13 Mar 2003 12:47:45 -0800

Alper,

I agree with you that most of the time there is implicit authorization with 
most
authentications (we are used to performing authentication for some access).
However what I am hinting at is authorization for network related service 
access,
not necessarily generic service access authorization.  For example, after 
authentication,
you have a range of network services you could access..authorization for them..
  Take APN concept in GRPS as an example (I am not suggesting to do this on
WLAN) but if you were to do it.. one way to do that communication 
request/authorization
between the NAP and the client is do via PANA (I know this is not the best 
example but
something that came to my mind in a short notice :-)

-Gopal