RE: review of NAS-Management-authorization

["David B. Nelson" <dnelson@elbrysnetworks.com>]

David Harrington writes...

> Why do we want to not conflate it with the named policy approach?

I have answers on several levels.

Generally speaking, conflating similar but distinct objects leads to the
potential for confusion.

The integer-valued CLI privilege level has a well established and widely
deployed set of semantics, which cannot be modified in order to make it fit
within a generalized network management access policy framework.

One data object is an Integer type and the other object is a Text string
type.  Their native formats are incompatible.

I firmly believe that structured attributes, if we are to do them, need to
be represented as grouped attributes pursuant to the RADIIUS Extended
Attribute proposal.  Structured attributes represented as sub-strings to be
parsed out from other strings is bad design (IMO).

Quite frankly, I see no need for structured attributes in this case.



--
to unsubscribe send a message to radiusext-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://psg.com/lists/radiusext/>