Subject: [eap] Issue 10: No support for acknowledged Success or Failure

From: [email-masked] (Bernard Aboba)
Date: Mon, 25 Mar 2002 11:04:55 -0800 (PST)

Issue 10: No support for Acknowledged Success and Failure
Submitter: Bernard Aboba
Submitter email address: [email-masked]
Date first submitted: March 25, 2002
Reference:
Document: RFC2284bis-02
Comment type: T
Priority: S
Section: 5

Rationale/Explanation of issue:

"Specifically, since EAP-Success is not ACK'ed, how can it be relied upon
to indicate things like "auth successful, go ahead and send packets"? It
seems to me that the NAS has to tell the client that auth is successful
via some other method ... at the moment the status quo seems to be to use
a timer and start sending packets if you don't see EAP-Success before the
timer expires, or watch for packets to arrive and decide auth must have
been successful if you see packets. As EAP gets used for more stuff, I
think this needs to get pinned down. If I remember correctly, 802.1x makes
a mistake like this and relies on EAP-Success being delivered successfully
in several of the state machines."
-- Simon Blake-Wilson

Add the following text to section 5:

5.x. Acknowledged Termination

Description

The Acknowledged Termination Type is used by the Authenticator to indicate
to the Peer the outcome of the authentication, and for the Peer to provide
a response to the Authenticator. By  acknowledging the receipt of the
Termination indication, and by providing its own view of the outcome of
the authentication, the peer and Authenticator sychronize their view of
the state of the authentication process. As with other EAP messages, the
Authenticator initiates the Acknowledged Termination conversation by
sending an EAP-Request/Acknowledged Termination. The Peer then responds
with an EAP-Response/Acknowleged Termination message. 
Since the Peer may have a different idea of the outcome of the
authentication than does the Authenticator, it is possible that the
EAP-Response/Acknowledged Termination message will contain a different
outcome than the EAP-Request/Acknowledged Termination message. 
Note that implementation of the Acknowledged Termination Type is optional,
so that a peer can NAK it. In this case, the Authenticator MUST respond
with an EAP Success or Failure packet. 

Type

254

Type-Data

The contents of the Type-Data field is summarized below. 

 0               
 0 1 2 3 4 5 6 7 8
+-+-+-+-+-+-+-+-+
|    Outcome    |
+-+-+-+-+-+-+-+-+
 
Outcome 

1 = Success 
2 = Failure