Subject: RE: [Pana] Issue150: PAA mandating separate authentication

From: Avi Lior <[email-masked]>
Date: Mon, 6 Dec 2004 20:12:39 -0500

Okay I understood that but maybe I am still missing something.  Since the
PAA lives in the Access network I would think that if it offers NAP
authentication that it should get it.  After all it seems that it's the
right thing to do.

Otherwise I actually don't understand why one would do NAP authentication.
And if it isnt clear then maybe we should simplify the model and only
support ISP authentication.  I think clients would just be configured to
ignore NAP authentication altogether.

Avi

> -----Original Message-----
> From: Alper Yegin [mailto:[email-masked]] 
> Sent: Monday, December 06, 2004 6:14 PM
> To: 'Avi Lior'; [email-masked]; [email-masked]
> Subject: RE: [Pana] Issue150: PAA mandating separate authentication
> 
> 
> Hi Avi,
> 
> Typically by default only ISP auth/authz is performed.
> The PANA design allows PAA to "offer" additional NAP 
> auth/authz, and lets PaC to "accept/deny" it. What it does 
> not do is to let PAA "mandate" NAP auth/authz.
> 
> Alper
> 
> 
> > -----Original Message-----
> > From: Avi Lior [mailto:[email-masked]]
> > Sent: Monday, December 06, 2004 12:50 PM
> > To: Alper Yegin; [email-masked]; [email-masked]
> > Subject: RE: [Pana] Issue150: PAA mandating separate authentication
> > 
> > Hmmmmm,  I don't get it.  If the PAA doesn't get to mandate NAP 
> > authentication then why have it in the first place?
> > 
> > Either get rid of NAP authentication or make it enforceable by the
> PAA.
> > 
> > 
> > 
> > > -----Original Message-----
> > > From: Alper Yegin [mailto:[email-masked]]
> > > Sent: Friday, December 03, 2004 5:33 PM
> > > To: [email-masked]; [email-masked]
> > > Subject: RE: [Pana] Issue150: PAA mandating separate 
> authentication
> > >
> > >
> > > > 	     This implies the PaC does not wish to do 
> separate NAP and
> > > > 	     ISP authentication. Only NAP or only ISP 
> authentication
> > > > 	     will be performed. The PAA should not refuse to
> > > > 	     authenticate a host that responds with S=0.
> > >
> > >
> > > So, the proposal is "PAA cannot mandate NAP authentication." I'm 
> > > fine with that.
> > >
> > > > Revised text proposal for the section on "S" bit:
> > > >
> > > > 	S(eparate)
> > > >
> > > > 	 When the S-flag is set in a PANA-Start-Request 
> message it
> > > >          indicates that PAA is willing to offer separate NAP and
> ISP
> > > >          authentication.  When the S-flag is set in a
> > > PANA-Start-Answer
> > > >          message it indicates that the PaC accepts on performing
> > > >          separate NAP and ISP authentication. The PaC may
> > > also respond
> > > >          with the S-flag not set which implies the PaC 
> has chosen
> to
> > > >          authenticate with either the NAP or the ISP only. When
> the
> > >
> > > I think this should be "ISP only" (not "NAP or ISP"). This is the 
> > > default mode of operation in access networks today.
> > >
> > > >          S-flag is set in a PANA-Auth-Request/Answer,
> > > >          PANA-FirstAuth-End-Request/Answer and
> > > >          PANA-Bind-Request/Answer messages it indicates
> > > that separate
> > > >          NAP and ISP authentication is being performed in the
> > > >          authentication phase.  For other cases, S-flag MUST NOT
> be
> > > set.
> > >
> > > Alper
> > >
> > >
> > >
> > > >
> > > > _______________________________________________
> > > > Pana mailing list
> > > > [email-masked]
> > > > https://www1.ietf.org/mailman/listinfo/pana
> > >
> > >
> > >
> > > _______________________________________________
> > > Pana mailing list
> > > [email-masked]
> > > https://www1.ietf.org/mailman/listinfo/pana
> > >
> 
> 

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Alper Yegin <[email-masked]>
Date: Tue, 07 Dec 2004 11:25:04 -0800

Hi Avi,

> Otherwise I actually don't understand why one would do NAP
authentication.

ISP authentication is always a must. You cannot get IP access without
it.

In addition to having an ISP account, some clients MAY also have a NAP
account. This optional subscription (which comes with a price) allows
the client to get differentiated service from the NAP. And for that the
clients who subscribed to the NAP as well will have to get authenticated
by the NAP. 

But again, not all clients have to have that subscription. Typically an
ISP account is all you need -- the business relation between the NAP and
ISP allows your client to use the NAP to reach ISP. In that case your
client does not get special treatment from the NAP.

This is my understanding... The requirement was brought up by Lionel
Morand (CC'ed). He can provide more information if necessary.

> ignore NAP authentication altogether.

The clients who do not have an account with the NAP can safely ignore
NAP authentication. They just perform the mandatory ISP authentication.
That's the current design.

Alper

authentication

---

From: Yoshihiro Ohba <[email-masked]>
Date: Tue, 07 Dec 2004 07:38:34 -0500

> That's the current design.

I think Avi's proposal was that when the client does not support NAP
authentication while the PAA offers separate authentication, then it
would be more flexibile if the PAA has a choice of either reverting to
ISP authentication or refusing to authenticate the PaC, instead of
always reverting to ISP authentication.  This does not seem to change
the basic design of the mandatory support of ISP authentication.

Yoshihiro Ohba

---

From: Alper Yegin <[email-masked]>
Date: Tue, 07 Dec 2004 14:42:01 -0800

> the basic design of the mandatory support of ISP authentication.

("reverting" might not be the best word for that. ISP authentication is
always done)

The current design treats NAP authentication as "something PAA may offer
and PaC may decline". Avi's proposal is for changing this to "something
PAA may offer and also mark it as either mandated or optional; and PaC
may decline if it is marked optional; PaC must perform it if it is
marked mandated".

Is this something useful that we want to support? [I don't have strong
opinion].

Alper

---

From: Yoshihiro Ohba <[email-masked]>
Date: Tue, 07 Dec 2004 11:27:47 -0500

> may decline if it is marked optional; PaC must perform it if it is

In the current design, there is no additinal flag used as the mark to
indicate whether the PAA mandate separate NAP and ISP authentication.
If such an additinal flag is needed to make Avi's proposal work, it
might not be so much useful considering the complexity to add the new
flag.

Yoshihiro Ohba