Subject: [Ips] Authentication in a discovery session

From: "Eddy Quicksall" <[email-masked]>
Date: Thu, 19 May 2005 16:27:44 -0400

Is Authentication allowed in a discovery session? I figure it is a good idea but I want to ask what the authors intended.

I may have missed something but in every case where I see Authentication mentioned with regards to an object, it always mentions an initiator and/or a target. I can't find an implication that a discovery session, which does not have a target, should support authentication.

Also, all of the examples show a TargetName supplied during AuthMethod. Could there be some authentication methods that require a target name?

Since discovery does not have a target, then is it intended that authentication during discovery is not expected or even allowed?

Eddy

_______________________________________________
Ips mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ips

---

From: William Studenmund <[email-masked]>
Date: Thu, 19 May 2005 16:12:16 -0700

On May 19, 2005, at 1:27 PM, Eddy Quicksall wrote:

> Is Authentication allowed in a discovery session? I figure it is a 
> good idea but I want to ask what the authors intended.

The Wasabi target supports authentication during discovery sessions. 
What it does not support is mutual CHAP during unnamed discovery 
sessions.

> I may have missed something but in every case where I see 
> Authentication mentioned with regards to an object, it always mentions 
> an initiator and/or a target. I can't find an implication that a 
> discovery session, which does not have a target, should support 
> authentication.

My take on this is that in an unnamed discovery session, we do have an 
initiator object. If that initiator object can be authenticated, by 
matching the CHAP name to a CHAP secret for any node available via a 
given portal, the it's allowed in for discovery and can discover all 
nodes available (as per the spec). Even nodes for which it hadn't 
authenticated in the discovery session.

Worded another way, say there are nodes A, B, and C available via a 
portal. An initiator logs in for a discovery session without a 
TargetName. In replying to the CHAP challenge, it supplies a CHAP name 
and a CHAP response. We find the first node that has an auth entry with 
that CHAP name. If the CHAP response is correct for the CHAP name, then 
the initiator is allowed in to see what's around. It could be that the 
name and password are that for node C. Nodes A and B are still 
mentioned in the discovery info.

> Also, all of the examples show a TargetName supplied during 
> AuthMethod. Could there be some authentication methods that require a 
> target name?

I personally feel that mutual CHAP requires a TargetName, so you know 
what target should authenticate itself to the initiator. :-)

> Since discovery does not have a target, then is it intended that 
> authentication during discovery is not expected or even allowed?

I believe it can be very useful to support authentication during 
discovery. Connections and sessions are limited resources. If you don't 
have authenticated discovery, then you open yourself up to potential 
DoS attacks.

However I do believe that if an initiator is able to log into a target 
without authentication, it is reasonable to permit it to discover said 
target without authentication. So don't use "None" on boxes on the 
public internet. :-)

Take care,

Bill

---

From: "Eddy Quicksall" <[email-masked]>
Date: Sat, 21 May 2005 09:06:35 -0400

>As an RDMA-aware initiator or target (the one that made the offer) will
>understand the key, it will not fall into the case above. It will
>merely find one of its offers was not understood. This latter behavior
>is the point of "NotUnderstood" and I agree we should NOT close the
>connection at that point.

Does the NotUnderstood reasoning only apply to login? Or does it also apply 
to FFP too?

Eddy

---

From: Julian Satran <[email-masked]>
Date: Sat, 21 May 2005 18:35:13 -0400

I think that this answer summarizes
the options available pretty well.

I wonder however if it not be wise for
the target portal to hide some of the targets behind it based on the supplied
initiator name (similar of the target ability to hide LUs  based on
the initiator name during a normal session).

Julo

William Studenmund <[email-masked]>

> [attachment "PGP.sig" deleted by Julian Satran/Haifa/IBM]

---

From: William Studenmund <[email-masked]>
Date: Mon, 23 May 2005 15:45:41 -0700

On May 21, 2005, at 3:35 PM, Julian Satran wrote:

> I think that this answer summarizes the options available pretty well.
> I wonder however if it not be wise for the target portal to hide some 
> of the targets behind it based on the supplied initiator name (similar 
> of the target ability to hide LUs  based on the initiator name during 
> a normal session).

Oh, heh, I thought we were already supposed to do that. :-)

We only announce a target over SendTargets discovery if it is 
conceivable that an initiator can log into it. So say a portal exports 
three nodes, A, B, and C. Further let there be a node D that isn't 
exported via this portal (no node-portal linkage). Let an initiator J 
be able to log into A using CHAP and NONE, and B using CHAP. Let it not 
be authorized to log into C, and let it be authorized to log into D 
(via a different portal as there is no node-portal linkage to this 
port).

If initiator J tries targetless discovery and either tries to skip 
security or chooses AuthMethod=NONE, we will let it in. In its 
SendTargets response (assuming All), we will tell it about nodes A, B, 
and D, with appropriate TargetAddress responses. As initiator J can't 
log into node C at all, we will not mention it. The initiator could 
also have completed CHAP using the credential(s) valid for node A or 
the one(s) for node B.

Obviously when initiator J tries to log into node B, it will have to 
perform CHAP using the right credential(s).

Does this seem unreasonable to anyone?

Take care,

Bill

---

From: "Eddy Quicksall" <[email-masked]>
Date: Tue, 24 May 2005 14:56:49 -0400

Sounds like a good plan.

Eddy

----- Original Message ----- 
From: "William Studenmund" <[email-masked]>
To: "Julian Satran" <[email-masked]>
Cc: <[email-masked]>; "Eddy Quicksall" 
<[email-masked]>
Sent: Monday, May 23, 2005 6:45 PM
Subject: Re: [Ips] Authentication in a discovery session

Take care,

Bill