Subject: Question: Authorization

From: Tschofenig Hannes <[email-masked]>
Date: Fri, 14 Mar 2003 11:37:52 +0100

hi all, 

it is true that authorization goes together with authentication. 

sometimes i get the impression that some people would like to see more than
a "binary authorization" result. (i know that this term is also a little bit
fuzzy and woule require further explaination.)

if so, what type of authorization would you like to see? 
furthermore: is this type of authorization result relevant for the pana
protocol itself?

ciao
hannes

> -----Original Message-----
> From: Gopal Dommety [mailto:[email-masked]]
> Sent: Thursday, March 13, 2003 9:48 PM
> To: Alper Yegin; [email-masked]; 
> [email-masked]
> Subject: Re: WG Last Call: draft-ietf-pana-usage-scenarios-04.txt
> 
> 
> Alper,
> 
> I agree with you that most of the time there is implicit 
> authorization with 
> most
> authentications (we are used to performing authentication for 
> some access).
> However what I am hinting at is authorization for network 
> related service 
> access,
> not necessarily generic service access authorization.  For 
> example, after 
> authentication,
> you have a range of network services you could 
> access..authorization for them..
>   Take APN concept in GRPS as an example (I am not suggesting 
> to do this on
> WLAN) but if you were to do it.. one way to do that communication 
> request/authorization
> between the NAP and the client is do via PANA (I know this is 
> not the best 
> example but
> something that came to my mind in a short notice :-)
> 
> -Gopal
> 
> 
> At 02:58 PM 3/12/2003 -0800, Alper Yegin wrote:
> >Hi Gopal,
> >
> >Thank you for the review.
> >
> >In the requirements draft, this is what we have:
> >
> >    In addition to carrying authentication information, PANA 
> MUST also
> >    provides only a binary authorization to indicate whether the PaC
> >    is allowed to access full IP services on the network. Providing
> >    finer granularity authorization, such as negotiating QoS 
> parameters,
> >    authorizing individual services (http vs. ssh), individual users
> >    sharing the same device, etc. is outside the scope of PANA.
> >
> >So, authentication and authorization goes hand-in-hand. Or, 
> in other words,
> >the network is authenticating the client to authorizing it 
> for network
> >access.
> >
> >We can make this more clear in the usage scenarios draft.
> >
> >So far we have been keeping the scope limited to "network 
> access service".
> >Do you mean PANA could be used as a generic service 
> authorization protocol,
> >that can be used with anything?
> >
> >alper
> >
> >
> >On 3/11/03 5:13 PM, "Gopal Dommety" <[email-masked]> wrote:
> >
> > > Hello All:
> > >
> > > I quickly went through the draft. My personal opinion is 
> that it would be
> > > good to expand the scope to include Authorization (of 
> services etc).
> > >
> > > This draft seems to indicate that  PANA is a protocol for 
> Authentication.
> > > It is not clear to me where we stand on authorization. 
> There have been
> > > occasional
> > > references to authorization (that makes me think the 
> authorization is in
> > > the scope). For example:
> > >
> > >
> > > 3.6. Limited Free Access
> > >
> > > "Certain networks might allow clients to access a limited 
> topology without
> > > any explicit authentication and authorization" and seems 
> to indicate that
> > > pana will be used to do authorization.
> > >
> > > 3.2. PANA with Link-Layer Security
> > >
> > > "But it (the existing gsm/cdma networks) does not 
> necessarily provide
> > > authorization at the network- layer which can be done by 
> authenticating the
> > > client to an ISP. So this still necessitates another layer of
> > > authentication. It should be noted that this second 
> authentication takes
> > > place over a secure channel"
> > >
> > >
> > > My personal opinion is that it would be good to expand 
> the scope to include
> > > Authorization (of services etc).  Let me know if you need 
> me to articulate
> > > it better or contribute.
> > >
> > >
> > > Thanks
> > > Gopal
> > >
> > >
>