[Isms] Multiple user namespaces (was RE: pre11 comments)

["David B. Nelson" <d.b.nelson at comcast.net>]

Changing the subject line...

Juergen Schoenwaelder writes...

> I assume we more or less agree that we have to be able to
> differentiate between names coming from different secure transport
> models. Any violent disagreement with this statement?

Yes.  I disagree.  This has nothing to do with different secure transport
models and everything to do with the underlying source of user identity.
The "tagging" needed to disambiguate the usernames needs to be tied not to
the protocol but to the source or identity, e.g. an administrative realm.
When the source of identity is the local database of the secure transport
implementation, we take the shortcut (incorrect, IMHO) of "tagging" with the
protocol name.
 
> If the above is correct, then question seems to be whether a) we by
> default make all the names different leaving it to explicit
> configuration to treat them the same if needed or b) we make them by
> default the same leaving it to explicit configuration to make them
> different where needed. Is this a fair statement?

That is certainly one decision to be made.

Another is the source, syntax and semantics of the "tagging" information.


_______________________________________________
Isms mailing list
Isms at ietf.org
https://www.ietf.org/mailman/listinfo/isms