--- 1/draft-ietf-dhc-options-uap-00.txt 2006-02-04 23:05:08.000000000 +0100 +++ 2/draft-ietf-dhc-options-uap-01.txt 2006-02-04 23:05:08.000000000 +0100 @@ -1,18 +1,18 @@ -Dynamic Host Configuration Working Group Steve Drach -INTERNET-DRAFT Sun Microsystems, Inc. - August 1998 - Expires February 1999 +Network Working Group S. Drach +INTERNET-DRAFT Sun Microsystems +Obsoletes: draft-ietf-dhc-options-uap-00.txt September 1998 + Expires March 1999 DHCP Option for User Authentication Protocol - + Status of this Memo This document is an Internet-Draft. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note that other groups may also distribute working documents as Internet-Drafts. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any @@ -20,87 +20,94 @@ material or to cite them other than as "work in progress." To view the entire list of current Internet-Drafts, please check the "1id-abstracts.txt" listing contained in the Internet-Drafts Shadow Directories on ftp.is.co.za (Africa), ftp.nordu.net (Northern Europe), ftp.nis.garr.it (Southern Europe), munnari.oz.au (Pacific Rim), ftp.ietf.org (US East Coast), or ftp.isi.edu (US West Coast). Abstract - This document defines a DHCP [1] option that contains a pointer to a - User Authentication Protocol server that provides user authentication - services for clients that conform to The Open Group Network Computer - Technical Standard. + This document defines a DHCP [1] option that contains a list of + pointers to User Authentication Protocol servers that provide user + authentication services for clients that conform to The Open Group + Network Computing Client Technical Standard [2]. Introduction - The Open Group Network Computer Technical Standard, a product of The - Open Group's Network Computer Working Group (NCWG), defines a network - computer user authentication facility named the User Authentication - Protocol (UAP). + The Open Group Network Computing Client Technical Standard, a product + of The Open Group's Network Computing Working Group (NCWG), defines a + network computing client user authentication facility named the User + Authentication Protocol (UAP). UAP provides two levels of authentication, basic and secure. Basic authentication uses the Basic Authentication mechanism defined in the - HTTP 1.1 [2] specification. Secure authentication is simply basic - authentication encapsulated in an SSLv3 [3] session. + HTTP 1.1 [3] specification. Secure authentication is simply basic + authentication encapsulated in an SSLv3 [4] session. In both cases, a UAP client needs to obtain the IP address and port of the UAP service. Additional path information may be required, - depending on the implementation of the service. A URL [4] is an + depending on the implementation of the service. A URL [5] is an excellent mechanism for encapsulation of this information since many UAP servers will be implemented as components within legacy HTTP/SSL servers. Most UAP clients have no local state and are configured when booted - through DHCP. No existing DHCP option [5] has a data field that + through DHCP. No existing DHCP option [6] has a data field that contains a URL. Option 72 contains a list of IP addresses for WWW servers, but it is not adequate since a port and/or path can not be - specified. Hence there is a need for an option that contains a URL. + specified. Hence there is a need for an option that contains a list + of URLs. User Authentication Protocol Option - This option specifies a URL pointing to a user authentication service - that will process authentication requests encapsulated in the User - Authentication Protocol (UAP). UAP servers can accept either HTTP - 1.1 or SSLv3 connections. If the URL does not contain a port - component, the normal default port is assumed (i.e., port 80 for http - and port 443 for https). + This option specifies a list of URLs, each pointing to a user + authentication service that is capable of processing authentication + requests encapsulated in the User Authentication Protocol (UAP). UAP + servers can accept either HTTP 1.1 or SSLv3 connections. If the list + includes a URL that does not contain a port component, the normal + default port is assumed (i.e., port 80 for http and port 443 for + https). If the list includes a URL that does not contain a path + component, the path /uap is assumed. 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ - | Code | Length | URL + | Code | Length | URL list +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Code TBD - Length The length of the data field (i.e., URL) in bytes. + Length The length of the data field (i.e., URL list) in + bytes. - URL URL pointing to the UAP service. + URL list A list of one or more URLs separated by the ASCII + space character (0x20). References - [1] Droms, R., "Dynamic Host Configuration Protocol", RFC-2131, - March 1997. + Droms, R., "Dynamic Host Configuration Protocol", RFC-2131, March + 1997. - [2] Fielding, R., Gettys, J., Mogul, J., Frystyk, H., and T. - Berners-Lee, "Hypertext Transfer Protocol -- HTTP/1.1", RFC- - 2068, January 1997. + Technical Standard: Network Computing Client, The Open Group, + Document Number C801, October 1998. - [3] Freier, A., Karlton, P., and P. Kocher, "The SSL Protocol, Ver- - sion 3.0", Internet Draft, November 1996. + Fielding, R., Gettys, J., Mogul, J., Frystyk, H., and T. Berners-Lee, + "Hypertext Transfer Protocol -- HTTP/1.1", RFC-2068, January 1997. - [4] Berners-Lee, T., Masinter, L., and M. McCahill, "Uniform - Resource Locators (URL)", RFC-1738, December 1994. + Freier, A., Karlton, P., and P. Kocher, "The SSL Protocol, Version + 3.0", Internet Draft, November 1996. - [5] Alexander, S. and R. Droms, "DHCP Options and BOOTP Vendor + Berners-Lee, T., Masinter, L., and M. McCahill, "Uniform Resource + Locators (URL)", RFC-1738, December 1994. + + Alexander, S. and R. Droms, "DHCP Options and BOOTP Vendor Extensions", RFC-2132, March 1997. Security Considerations DHCP currently provides no authentication or security mechanisms. Potential exposures to attack are discussed in section 7 of the DHCP protocol specification. Author's Address