Re: Scope of applicability for CUI

["Alan DeKok" <aland@ox.org>]

Avi Lior <avi@bridgewatersystems.com> wrote:
> Not 100% accurate. User-Name may only be used for routing. Right?

  ... to the home server, which is the only one that can establish
user identity.  In addition, the User-Name often contains the identity
of the home server.

  It's a matter of getting to a common terminology.

> Again not 100% accurate.  We can't really say what class is used for.

  It's used by each proxying server, to associate it's local, private,
meaning to a session.

> So to make sure that we are 100% accurate: the identity is not for for the
> homenetwork its for the those outside the homenetwork that require this
> assertion by the home network to do business.

  I agree.

> I suppose this can be correct.  That is if we agree that Class is used for
> identity tracking.

  Not "user" identity, but "session" identity.

> -We can't use Class to do what we want because the standards already tell us
> what Class is used for.

  Agreed.

  I just want to be sure I understand the threat models of CUI, and
that it's design and/or description addresses those threats.

  Alan DeKok.

--
to unsubscribe send a message to radiusext-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://psg.com/lists/radiusext/>