Re: NETCONF over TLS

[Martin Bjorklund <mbj@tail-f.com>]

badra@isima.fr wrote:
> I will update the draft consequently, or send a separated document for
> <rpc-login> with NETCONF.

I think this is crucial for the TLS transport to work for NETCONF.
RFC4741 says in section 2.3:

   NETCONF connections must be authenticated.  The transport protocol is
   responsible for authentication. 

   [...]

   The authentication process should result in an identity whose
   permissions are known to the device.

I don't see how this requirement is met with the current draft.

So, adding a <login> rpc to this document is probably a good idea.
But do we want to limit TLS usage to using the <login> method?  People
are also using some field in the 'subject' of a client certificate to
get a user name (or other info) which is then mapped to access
rights.


/martin


--
to unsubscribe send a message to netconf-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/netconf/>