RE: Response to the review comments on draft-ietf-dhc-agentopt-radius-06.txt

["Nelson, David" <dnelson@enterasys.com>]

Bernard Aboba writes...

> Ralph Droms has posted suggested resolutions to the AAA-Doctors
comments
> on draft-ietf-dhc-agentopt-radius-06.txt.  Earlier I sent out a
summary of
> the issues raised in the review.
> 
> Please respond to this list whether the proposed resolutions are
> acceptable to you.  I will collect the feedback and send it to Ralph.

I would like to propose that the RADIUS User-Name attribute MUST NOT be
included in a DHCP sub-option.  The response from Ralph Droms indicates
(to my reading) that there is no specific purpose for the inclusion of
User-Name, but that it causes no harm to include it, so that DHCP
servers have an accurate picture of the authentication and authorization
state of the session.

Since there is no specific requirement for the DHCP server to know the
User-Name (or other user identity), the provisioned authorization data
being sufficient, I would rather avoid the potential for future
expansion and abuse of this DHCP option such that DHCP servers
effectively become authentication and authorization servers, competing
with existing solutions such as RADIUS and Diameter.  I think that this
is an important restriction to impose.

-- Dave