Re: Status of RADIUS

[Bernard Aboba <aboba@internaut.com>]

AAA (Diameter and RADIUS) are special in this regard. The need for new
work is largely tied to an application. The existing RFCs and AAA WG
work items lay out how to do network access using AAA -- but if more work
is to be done, a pre-requisite is the sponsorship of the WG or SDO for
whom the AAA application applies.

So if we want to do AAA for SIP, AAA for 3GPP, etc. there has got to be a
WG or SDO sponsor who says "I want this done and here are the
requirements". Requiring a sponsor for new work items prevents AAA-related work from
being "spontaneously generated" without any defined need or set of
requirements. Experience has shown that AAA WG is incapable of doing
design work in an area that is still ill-defined -- it's like trying to
detail a moving car. The AAARCH IRTF WG was created in part to work on
honing some of those ill-defined areas, but it seems to have gone dormant.

A good example of this is MIPv6/AAA. Until the proposed architecture is
validated by the WG in that speciality (MOBILEIP or its successors) the
right answer is to not add a WG work item, even if the request comes from
an SDO (3GPP2 in this case). This is the right approach even though
there *may* be valid needs which the existing MIPv6 drafts do not
satisfy (e.g. total handoff time) -- but those problems need to be
articulated first, and get buyoff from MOBILEIP WG before it is concluded
that a AAA "solution" is needed.

A possible exception to this are items relating to the security of all AAA
applications.

In terms of handling things when a WG isn't "there" we do have examples of
WGs that can handling ongoing miscellaneous items -- TSVWG WG.

On Sat, 1 Feb 2003, Harald Tveit Alvestrand wrote:

> a metacomment..... something to think about, not something that changes
> what should be done here.....
>
> We (claim that we) shut down working groups when they're done.
> And we don't create working groups until it's clear that something needs to
> be done.
>
> this means that at any given time, a problem area may or may not have
> active working groups.
> so saying that "we won't consider requirements that don't come from a WG"
> is not always going to be the best policy.
>
> tangential.... I think the IETF needs some recognizable entities that are
> able to handle things when a WG isn't "there". And the IESG is not "it".
>
> just a thought.
>
>                  Harald
>