Re: [Isms] Multiple user namespaces

["David B. Nelson" <dnelson at elbrysnetworks.com>]

Juergen Schoenwaelder writes...

> The mappings then become part of the SNMP configuration and
> I do not see a multi-vendor interoperability issue
> (at least nothing worse than what we are used to ;-).

Well, perhaps.  I thought part of the issue with non-deployment of SNMPv3
that we are attempting to solve was that the configuration required today
*is* too complicated.

> We need to figure out how we can keep simple installations
> simple and put the costs on more complex installations.

OK, that *sounds* good.

> This might require [us] to think about a wildcarding mechanism
> that allows me to specify a policy such as "all SSH user names
> not listed in the table are passed unaltered as securityNames" or 
> "all TLS/DTLS names not found in the table are mapped to a 
> specific securityName (so VACM can deny access for example)".

The issue arises when there are multiple authentication methods (i.e.
multiple user namespaces).  That most often occurs with there are multiple
transport protocols.  I think that is likely already outside the "80% rule",
and that the simple case is a single protocol with a single user namespace.


_______________________________________________
Isms mailing list
Isms at ietf.org
https://www.ietf.org/mailman/listinfo/isms