rfc-2485

DHCP Option for The Open Group's User Authentication Protocol

S. Drach

date1999-01 streamIETF areaint wgdhc statusPROPOSED STANDARD pages4 canonicalhttps://www.rfc-editor.org/rfc/rfc2485 doi10.17487/RFC2485

This document defines a DHCP option that contains a list of pointers to User Authentication Protocol servers that provide user authentication services for clients that conform to The Open Group Network Computing Client Technical Standard. [STANDARDS-TRACK]

Extracted elements (5)

design-rationale §Introduction

A URL was chosen as the encapsulation mechanism for UAP server location because many UAP servers are implemented as components within legacy HTTP/SSL servers, and a URL naturally captures IP address, port, and path information. Existing Option 72 (WWW servers) was inadequate because it only stores IP addresses without port or path.

normative-requirement §User Authentication Protocol Option SHOULD

If a URL in the UAP option list does not contain a path component, the path /uap is assumed.

protocol-element §User Authentication Protocol Option

DHCP Option 98 (UAP) specifies a list of URLs pointing to User Authentication Protocol servers. UAP servers can accept either HTTP 1.1 or SSLv3 connections.

pkix, security

security-consideration §Security Considerations

DHCP provides no authentication or security mechanisms, and a UAP client has no means to detect whether it is communicating with a rogue authentication service resulting from a forged or compromised UAP option. Even SSLv3-based secure authentication does not protect against this attack; mitigation relies on environmental assumptions in the Network Computing Client Technical Standard.

security

wire-format §User Authentication Protocol Option

The UAP DHCP option has a Code field of 98, a Length field indicating the byte length of the URL list, and a URL list field containing one or more URLs separated by the ASCII space character (0x20).