Subject: Re: [abfab] Comments on draft-ietf-abfab-eapapplicability-00.txt

From: "Jim Schaad" <[email-masked]>
Date: Wed, 1 Aug 2012 18:14:37 -0700

Sam or Josh,

After writing the below and trying to get a good night sleep.

> 6. I think that you might talk about the cases where channel binding COULD
> be required even for network authentication.  The fact that it is not
required
> does not mean that it cannot be used.  One issue is going to be how an IdP
> identifies a network authentication service from a different service for
the
> purposes of deciding if channel binding is going to be required.

I seem to remember at one point that there were some discussions about
possibly using abfab for granting of network access of some types of
devices.  Do I remember incorrectly or is this still a possible usage that
might need to be considered in the applicability statement.

Jim

---

From: Leif Johansson <[email-masked]>
Date: Thu, 02 Aug 2012 03:46:37 +0200

On 08/02/2012 03:14 AM, Jim Schaad wrote:
>> 6. I think that you might talk about the cases where channel
>> binding COULD be required even for network authentication.  The
>> fact that it is not
> required
>> does not mean that it cannot be used.  One issue is going to be
>> how an IdP identifies a network authentication service from a
>> different service for
> the
> I seem to remember at one point that there were some discussions
> about possibly using abfab for granting of network access of some
> types of devices.  Do I remember incorrectly or is this still a
> possible usage that might need to be considered in the
> applicability statement.

Isn't that too deep a recursion for us?

---

From: "Diego R. Lopez" <[email-masked]>
Date: Thu, 02 Aug 2012 05:10:55 +0000

> might need to be considered in the applicability statement.

There was a position statement presented by Sam and Margaret at the Smart
Object Security workshop before the IETF in Paris. You probably refer to
this. I'm attaching the text, that does not explicitly mention network
access, but I guess suggests the possibility...

Be goode,

--
"Esta vez no fallaremos, Doctor Infierno"

Dr Diego R. Lopez
Telefonica I+D
http://people.tid.es/diego.lopez/

e-mail: [email-masked]
Tel:    +34 913 129 041
Mobile: +34 682 051 091
-----------------------------------------

________________________________

Este mensaje se dirige exclusivamente a su destinatario. Puede consultar nuestra pol?tica de env?o y recepci?n de correo electr?nico en el enlace situado m?s abajo.
This message is intended exclusively for its addressee. We only send and receive email on the basis of the terms set out at.
http://www.tid.es/ES/PAGINAS/disclaimer.aspx

---

From: Sam Hartman <[email-masked]>
Date: Mon, 06 Aug 2012 18:06:36 -0400

My personal preference is to keep network access discussions out of
scope here.

I think the IDP can detect gss-eap based on the RADIUS AVPs such as
acceptor-hostname and acceptor-realm that are sent by GSS-EAP.

If another ABFAB application integration layer is used, then it may get
more complex.

My personal belief is that level of detail is not needed for the
applicability statement.

---

From: Leif Johansson <[email-masked]>
Date: Tue, 07 Aug 2012 00:17:30 +0200

On 08/07/2012 12:06 AM, Sam Hartman wrote:
> My personal preference is to keep network access discussions out
> of scope here.
> 
> I think the IDP can detect gss-eap based on the RADIUS AVPs such
> as acceptor-hostname and acceptor-realm that are sent by GSS-EAP.
> 
> If another ABFAB application integration layer is used, then it may
> get more complex.
> 

Nothing stops us from updating the applicability stmt at that time.

---

From: Josh Howlett <[email-masked]>
Date: Tue, 7 Aug 2012 08:21:50 +0000

+1

On 06/08/2012 23:06, "Sam Hartman" <[email-masked]> wrote:

>_______________________________________________
>abfab mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/abfab

Janet is a trading name of The JNT Association, a company limited
by guarantee which is registered in England under No. 2881024 
and whose Registered Office is at Lumen House, Library Avenue,
Harwell Oxford, Didcot, Oxfordshire. OX11 0SG