Diameter as a Carrier Protocol for SASL
draft-vanrein-diameter-sasl-00

• Status
• IESG evaluation record
• IESG writeups
• Email expansions
• History

• Versions
• 00

Network Working Group                                        R. Van Rein
Internet-Draft                                                 ARPA2.net
Intended status: Standards Track                        November 4, 2018
Expires: May 8, 2019

                Diameter as a Carrier Protocol for SASL
                     draft-vanrein-diameter-sasl-00

Abstract

   Diameter is a scalable protocol to support authentication and
   authorisation inquiries.  It handles a variety of challenge and
   response types for applications such as network access.  For use in
   application protocols, a different class of challenge and response
   types are needed, most commonly captured in SASL.  This specification
   allows SASL handshakes to be carried in Diameter messages.

Status of This Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at https://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on May 8, 2019.

Copyright Notice

   Copyright (c) 2018 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (https://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of

Van Rein                   Expires May 8, 2019                  [Page 1]
Internet-Draft                Diameter SASL                November 2018

   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.

Table of Contents

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
   2.  Embedding SASL in Diameter  . . . . . . . . . . . . . . . . .   3
     2.1.  AVP Definitions for SASL  . . . . . . . . . . . . . . . .   3
       2.1.1.  SASL-Mechanisms . . . . . . . . . . . . . . . . . . .   3
       2.1.2.  SASL-Encrypted-Token  . . . . . . . . . . . . . . . .   4
       2.1.3.  SASL-Channel-Binding  . . . . . . . . . . . . . . . .   6
     2.2.  Server Name Binding . . . . . . . . . . . . . . . . . . .   8
   3.  Security Considerations . . . . . . . . . . . . . . . . . . .   9
   4.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .   9
   5.  References  . . . . . . . . . . . . . . . . . . . . . . . . .  10
     5.1.  Normative References  . . . . . . . . . . . . . . . . . .  10
     5.2.  Informative References  . . . . . . . . . . . . . . . . .  11
   Appendix A.  Diameter Message Examples  . . . . . . . . . . . . .  11
   Appendix B.  Acknowledgements . . . . . . . . . . . . . . . . . .  11
   Author's Address  . . . . . . . . . . . . . . . . . . . . . . . .  11

1.  Introduction

   SASL [RFC4422] is a general standard for inserting authentication and
   authorisation strings into protocols to alles clients to authenticate
   to servers.  The format is general, and indeed quite list of security
   mechanisms have been crafted to fit its shape.  SASL is also generic
   in terms of how it can be embedded into the protocols that desire
   authentication and authorisation, and again it is used in many
   protocols.

   Diameter, being targeted at authentication and authorisation, has
   never been setup with support for SASL.  This is perhaps because
   Diameter is often used with network-level access control, where the
   EAP protocol usually takes care of these tasks; SASL is mostly used
   with application protocols.  The design of Diameter however, is
   flexible enough to be very useful to this class of protocols as well.

   By carrying SASL in Diameter messages, a few interesting usage
   scenarios are enabled.  First, due to the ability to take SASL
   strings from one protocol and forward them in another, we can use
   Diameter as a connection to a backend service that conceals
   credentials from the applications that rely on them.  In a variation
   on the first scenario, the second usage scenario addresses the domain
   of a user to validate against credentials held there.  We refer to
   that as BYOID, short for Bring Your Own IDentity.

Van Rein                   Expires May 8, 2019                  [Page 2]
Internet-Draft                Diameter SASL                November 2018