Subject: RE: [Dime] Supplicant X.509 AVP?

From: Madjid Nakhjiri <[email-masked]>
Date: Thu, 01 Feb 2007 16:45:42 -0800

It is understandable to not want to touch the app. However, it seems that
the authentication and application authorization (using the cert) needs to
happen before the application starts, so how do you want to handle the AAA
exchange, something must trigger the exchange and that something has to come
from the application itself.

Madjid

-----Original Message-----
From: Morrow, Glenn [mailto:[email-masked]] 
Sent: Tuesday, January 30, 2007 4:55 PM
To: Morrow, Glenn; Glen Zorn (gwz); Madjid Nakhjiri
Cc: [email-masked]; Hannes Tschofenig
Subject: RE: [Dime] Supplicant X.509 AVP?

We also don't want to have to have to transport the cert at all at the
application level - just start signing and digesting from the get go -
granted challenge/nonce etc.. needed later as well.

-----Original Message-----
From: Morrow, Glenn 
Sent: Tuesday, January 30, 2007 5:49 PM
To: 'Glen Zorn (gwz)'; Madjid Nakhjiri
Cc: [email-masked]; Hannes Tschofenig
Subject: RE: [Dime] Supplicant X.509 AVP?

Yes there are other protocols that pass certs and these would likely be
used as the backend for the Diameter Server. I.e. the Diameter Server is
the application to these existing protocols. We just don't want to have
to do two dips and that is why we want to transport the cert with
Diameter - get it all done with one transaction from the Diameter
client/Application Server perspective - not two. 

> 
> Seems like a Diameter based cert status checking mechanism..

Hmm -- that's not what I'm getting at all, but if you're right it seems
like there are already at least a couple of other standard protocols
that do this...

...

This communication is the property of Qwest and may contain confidential or
privileged information. Unauthorized use of this communication is strictly 
prohibited and may be unlawful.  If you have received this communication 
in error, please immediately notify the sender by reply e-mail and destroy 
all copies of the communication and any attachments.

_______________________________________________
DiME mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dime