Subject: [Ace] Authorization server: a constrained device?

From: Hannes Tschofenig <[email-masked]>
Date: Thu, 13 Mar 2014 14:27:49 +0100

Hi all,

reading through Sam's email and various comments during the BOF I was
wondering whether the group has a consensus to assume that the
authorization is not a constrained device.

In earlier discussions we said that the client and/or the resource
server are constrained.

Thoughts?

Ciao
Hannes

---

From: Olaf Bergmann <[email-masked]>
Date: Thu, 13 Mar 2014 16:27:45 +0100

>From what I took from the discussions since the Berlin IETF that
eventually led to the ACE BoF, I always had the impression that the
Authorization Server is regarded as not constrained in non-trivial
use-cases.

Gruesse
Olaf

---

From: Hannes Tschofenig <[email-masked]>
Date: Thu, 13 Mar 2014 17:07:49 +0100

Hi Olaf,

thanks for sharing your views.

The discussions before the BOF happened in a rather small group (mostly
offline) and now we have a larger audience and so it seemed to be fair
to re-state the question again (particularly after reading Sam's email).

Ciao
Hannes

On 03/13/2014 04:27 PM, Olaf Bergmann wrote:
> _______________________________________________
> Ace mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ace
>

---

From: Likepeng <[email-masked]>
Date: Fri, 14 Mar 2014 06:43:19 +0000

If Authorization Server is also constrained, there is no much benefit to have it in the architecture.

Kind Regards
Kepeng

> -----邮件原件-----
> 发件人: Ace [mailto:[email-masked]] 代表 Hannes Tschofenig
> 发送时间: 2014年3月14日 0:08
> 收件人: Olaf Bergmann
> 抄送: [email-masked]
> 主题: Re: [Ace] Authorization server: a constrained device?
> 
> Hi Olaf,
> 
> offline) and now we have a larger audience and so it seemed to be fair to
> re-state the question again (particularly after reading Sam's email).
> 
> Ciao
> Hannes
> 
>

---

From: Hannes Tschofenig <[email-masked]>
Date: Thu, 13 Mar 2014 21:18:05 +0100

There is still a lot of benefit since it allows to centrally manage
authorization, which is from a usability point of view a big plus.
Today, with the pairing approach you need to introduce each device to
any other device (leading to the handshake problem with n(n-1)/2
combinations).

Having said that I am fine with just assuming that the authorization
server is not constrained.

Ciao
Hannes

---

From: Bert Greevenbosch <[email-masked]>
Date: Mon, 17 Mar 2014 07:31:23 +0000

Hi Hannes,

The AS currently has two functions:

(1) Providing access permissions
(2) Assisting constrained resource server or client in making security decisions

Especially (2) indicates that the AS is not constrained.

I guess this is quite in-line with the parallel discussion "Constrained Authorization Server". "Constrained" is a somewhat vague term, but I think we should assume more than class 2 for the AS.

Depending on the protocols we are using, the AS may need to do quite some bookkeeping, e.g. of CRLs and maybe have a database about the constrained devices it may serve, as well as their (active and/or available) permissions.

Best regards,
Bert

> -----Original Message-----
> From: Ace [mailto:[email-masked]] On Behalf Of Hannes Tschofenig
> Sent: 14 March 2014 04:18
> To: Likepeng; Olaf Bergmann
> Cc: [email-masked]
> Subject: Re: [Ace] Authorization server: a constrained device?
> 
> >> offline) and now we have a larger audience and so it seemed to be
> >> fair to re-state the question again (particularly after reading
> Sam's email).
> >>
> >> Ciao
> >> Hannes
> >>
> >>
> >>>> reading through Sam's email and various comments during the BOF I
> >>>> was wondering whether the group has a consensus to assume that the