Subject: [AAA-WG]: CMS sec 1.6 - interpretation of "MUST belong to the same realm"

From: Johan Johansson <[email-masked]>
Date: Mon, 04 Feb 2002 12:01:17 +0000

To give more context, the section entitled "Who can authorize users" 
states that:

...note that one of praticipants of a DSA (specifically the one in the 
home network) MUST belong to the same realm as the user being authorized 
(the realm portion of the Network Access Identifier found in the 
User-Name AVP)...

I suppose that the intent is not to make it impossible for an isp to 
serve more than one realm per server, so does this mean that the server 
will need an X.509 certificate for every realm it serves (as defined by 
having an ACTION_LOCAL route for that realm)?

j

---

From: Stephen Farrell <[email-masked]>
Date: Mon, 04 Feb 2002 14:17:50 +0000

Quoting a bit more from 1.6:

"The realm of the participants is found in the
   subjectAltName field of the Diameter server's X.509 certificate."

subjectAltName is an ASN.1 "SEQUENCE OF" - the result is that a
single certificate can include many names, from the same or 
different realms. All you need to do is find a single CA that'll
create such a certificate, but that's out of scope of Diameter
(though not, I believe, a big deal technically).

Anything in the draft to the contrary would, IMHO, be a bug.

Stephen.

-- 
____________________________________________________________
Stephen Farrell         				   
Baltimore Technologies,   tel: (direct line) +353 1 881 6716
39 Parkgate Street,                     fax: +353 1 881 7000
Dublin 8.                mailto:[email-masked]
Ireland                             http://www.baltimore.com