RE: RADIUS Extension for Management Authorization Draft

["Nelson, David" <dnelson@enterasys.com>]

Barney Wolff writes... 

> I agree completely with split-horizon.  That's why I'm uncomfortable
with
> SSO.  I'd be much happier if the outside user had to go through two
> stages, one to get "inside" and the next to do things on the NAS.

I agree that three are potential security issues with SSO in a
multi-party proxy RADIUS environment.  I also believe that SSO has real
value and applicability in enterprise environments, which typically have
a single administrative domain.  For that reason, I think it is worthy
of consideration.  The issues you raise can be addressed effectively
using the split-horizon approach.

-- Dave



--
to unsubscribe send a message to radiusext-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://psg.com/lists/radiusext/>