Subject: [netmod] RADIUS enhancement to ietf-system

From: "Lange, Jeffrey K (GE Energy)" <[email-masked]>
Date: Fri, 2 Nov 2012 19:34:51 +0000

I've realized that there is a rather critical configuration component missing from the RADIUS configuration section of the ietf-system model.  There is no way to specify the authentication type to use for a server (PAP/CHAP/EAP etc...)

I have added the following to the model, and I'm passing it along in hopes that it can make it into the official model.

I have included the types PAP,CHAP, and EAP-MD5.  There are a plethora other types, as well, but I think these are probably the most common.  This is why I created it as an identity as opposed to an enumeration.

I guess there are a few general questions

1)      Should this be included in the standard model (I clearly think yes)

2)      Should more types be defined (MS-CHAP / MS-CHAPv2 / SIP Digest / LEAP / Cisco LEAP / etc...), this gets tricky for things like EAP-TLS where you also need to configure keying material.

3)      Should each identity be wrapped in a feature that determines whether or not the device supports that particular Auth type? Or should the server validate the settings at runtime?

Thanks
-Jeff Lange

diff --git a/data_model/[email-masked] b/data_model/[email-masked]
index a0b69f6..f37eb2e 100644
--- a/data_model/[email-masked]
+++ b/data_model/[email-masked]
@@ -237,6 +237,49 @@ module ietf-system {
       configured users.";
   }
+  identity radius-authentication-type {
+    description
+      "Base identity for RADIUS authentiation types.";
+  }
+
+  identity radius-PAP {
+    base radius-authentication-type;
+    description
+      "RADIUS messages will use the PAP authentication mechanism.";
+    reference
+      "RFC 2865: Remote Authentication Dial In User Service (RADIUS)
+       RFC 2869: RADIUS Extensions
+       RFC 5607: Remote Authentication Dial-In User Service (RADIUS)
+                 Authorization for Network Access Server (NAS)
+                 Management";
+  }
+
+  identity radius-CHAP {
+    base radius-authentication-type;
+    description
+      "RADIUS messages will use the CHAP authentication mechanism.";
+    reference
+      "RFC 2865: Remote Authentication Dial In User Service (RADIUS)
+       RFC 2869: RADIUS Extensions
+       RFC 5607: Remote Authentication Dial-In User Service (RADIUS)
+                 Authorization for Network Access Server (NAS)
+                 Management";
+  }
+
+  identity radius-EAP-MD5 {
+    base radius-authentication-type;
+    description
+      "RADIUS messages will use the EAP-MD5 authentication mechanism.";
+    reference
+      "RFC 2284: Extensible Authentication Protocol (EAP)
+       RFC 2865: Remote Authentication Dial In User Service (RADIUS)
+       RFC 2869: RADIUS Extensions
+       RFC 3579: RADIUS Support For Extensible Authentication Protocol (EAP)
+       RFC 5607: Remote Authentication Dial-In User Service (RADIUS)
+                 Authorization for Network Access Server (NAS)
+                 Management";
+  }
+
   /*
    * Top-level container
    */
@@ -549,6 +592,14 @@ module ietf-system {
           reference
             "RFC 2865: Remote Authentication Dial In User Service";
         }
+        leaf authentication-type {
+          type identityref {
+            base radius-authentication-type;
+          }
+          default radius-PAP;
+          description
+            "The authentication type used by the RADIUS server.";
+        }
       }
       container options {
         description