Subject: Re: SLP for Capabilities Discovery

From: James Kempf <[email-masked]>
Date: Thu, 22 Apr 1999 14:11:25 -0700 (PDT)

Alan,

Thanx for you comments.

>SLP of course currently only works over intranets, but we've been working
>with Apple to figure out how to expand its functionality to an Internet
>environment.  What we came up with, I believe, is basically what you
>propose.  An organization which wanted to make AFP (or other) services
>publically available over the Internet would simply set up a DA with a list
>of such services.  A client (UA) on the Internet would connect to that DA
>(either through knowing that DA's host name or some other mechanism) and
>obtain the list of available URLs.  The UA could then display that list for
>the user, who could point-and-click as they do today.  It would be very
>cool.
>

Yes indeed! And it would be even more cool if SLP could fufill the
RESCAP requirements as well.

>Is what I'm suggesting here doable under your proposal?  I think it is, but
>want to be sure.

Yes, it would be doable. 

>  One thing I don't understand is the need for a new port
>number on the DA.  Is that just to prevent someone from being able to add
>services from the Internet side? If so, it would seem there would be other
>ways of preventing this.  It seems to me that it would be best if no new
>port needed to be used, since just about everything else from the protocol
>perspective remains the same.  It would be great if a UA always did the
>same thing, regardless of whether it was talking to an intranet or
>Internet-based DA.
>

There are basically two reasons for the new port number:

1) In addition to disallowing registrations, the procedure for discovering
DAs is completely different on the Internet. The DA does not respond
to multicast SrvRqsts for DAAdverts, and it does not send out
a periodic heartbeat DAAdvert. These changes suggested that a new
port number is in order.

2) If the standard SLP port is used and registrations are disallowed
on the DA, then how will SAs be able to register with it? One could
come up with some sort of procedure, like having the DA reject
any registrations that came from addresses outside the domain, but
in light of point 1 above, it seemed more appropriate to use a different
port number. 

With a separate port number, there is a clear separation
between administrative access from within the domain by SAs (and potentially
UAs as well) and access from without. An administrators can easily
turn off Internet access without affecting internal users by simply
disabling the Internet port.

		jak

---

From: Keith Moore <[email-masked]>
Date: Thu, 22 Apr 1999 21:07:07 -0400

SLP is not a candiate solution for RESCAP.  They are in very
different spaces and it would be a Bad Idea to try to make
the same tool do both jobs.

Keith

---

From: [email-masked]
Date: Fri, 23 Apr 1999 07:49:17 -0700

>a periodic heartbeat DAAdvert. These changes suggested that a new

Although the port number is certainly part of the DA discovery process, DA
discovery seems to be only a small part of SLP as a whole.  The parts of
SLP that will continue to be used over the Internet seem more significant
to me.

>in light of point 1 above, it seemed more appropriate to use a different

To me the Internet-DA registration process seems implementation-dependent.
We were envisioning some sort of manual or semi-manual registration with an
Internet-supporting DA, so that not every SA could just go ahead and
register with it.  At the very least, you would need some sort of policy on
the DA which says "only export the following services if they register with
you."  In many cases we were envisioning the Internet DA as a type of
"standalone" device, with no real connection with its intranet.  It could
live in the firewall or router, for instance, and be administered in much
the same way.  Although an intranet and Internet DA could be combined in
one box, in many cases I would think they would want to be separate.

>disabling the Internet port.

What you say also makes sense.  I continue to believe, however, that it's
important for an SA to really not need to know the difference between an
intranet and Internet-based DA once the discovery process is completed.  If
part of that discovery process returns the port number, then either way
probably works.  Perhaps this is the answer: ensure that SLPv2 always
returns the port number as part of the discovery process.  Does it do this
already?

+-----+
|     |   Alan Oppenheimer
|     |   Open Door Networks, Inc.
|o    |   Internet solutions as easy to use as the Macintosh itself
|     |   [email-masked]
|     |   http://www.opendoor.com
+-----+

---

From: "John Veizades" <[email-masked]>
Date: Fri, 23 Apr 1999 08:03:02 -0700

The mechanism I would use to make a service available to the Internet at
large is to have a DA in an organization with a well known SCOPE value that
indicated that all services registered with this service would be exported
globally.  This avoids the need for an additional port number and makes the
service much like any other DA.  Exporting this particular service to the
world could be done in DNS or LDAP.

This service would still have to operate as a standard DA in the intranet so
why would it not continue to act like a normal DA in the intranet?

John...
----- Original Message -----
From: <[email-masked]>
To: James Kempf <[email-masked]>; <[email-masked]>;
<[email-masked]>
Sent: Friday, April 23, 1999 7:49 AM
Subject: Re: SLP for Capabilities Discovery