Subject: [Pana] Issue150: PAA mandating separate authentication

From: [email-masked]
Date: Wed, 1 Dec 2004 12:33:29 -0600

Issue 150: http://danforsberg.info:8080/pana-issues/issue150

> > Can the PAA refuse to authenticate if the PaC sets S-Flag to 0 in
> > the answer message?  If yes, there should be a way to indicate this
> > decision by the PAA to the PaC.
> 
> Hmmm. I never thought that the PAA may want to mandate separate
> authentication. What do you/others think? If this is a useful/practical
> scenario, we may need to add one more bit (like Mandatory/Optional).
> 

I don't know whether this is useful/practical, but it would be easy to
modify the specification to support the case.  I don't mind adding
such functionality.

Proposed resolution: 

In section 7.2 :
Current text:
"
      S(eparate)

         When the S-flag is set in a PANA-Start-Request message it
         indicates that PAA is willing to offer separate NAP and ISP
         authentication.  When the S-flag is set in a PANA-Start-Answer
         message it indicates that the PaC accepts on performing
         separate NAP and ISP authentication.  When the S-flag is set in
         a PANA-Auth-Request/Answer, PANA-FirstAuth-End-Request/Answer
         and PANA-Bind-Request/Answer messages it indicates that
         separate NAP and ISP authentication is being performed in the
         authentication phase.  For other cases, S-flag MUST NOT be
         set. 
"

Discussion: 
	    Scenario 1:
	    PAA			PaC
	    ---			---
	     ------------------->PANA-Start-Request (S=1)
	     <-------------------PANA-Start-Answer  (S=1)

	     Separate NAP and ISP authentication will be performed.

	     In case the PaC responds with
	     <-------------------PANA-Start-Answer  (S=0) 
	    
	     This implies the PaC does not wish to do separate NAP and
	     ISP authentication. Only NAP or only ISP authentication
	     will be performed. The PAA should not refuse to
	     authenticate a host that responds with S=0.

Revised text proposal for the section on "S" bit:

	S(eparate)

	 When the S-flag is set in a PANA-Start-Request message it
         indicates that PAA is willing to offer separate NAP and ISP
         authentication.  When the S-flag is set in a PANA-Start-Answer
         message it indicates that the PaC accepts on performing
         separate NAP and ISP authentication. The PaC may also respond
         with the S-flag not set which implies the PaC has chosen to
         authenticate with either the NAP or the ISP only. When the
         S-flag is set in a PANA-Auth-Request/Answer,
         PANA-FirstAuth-End-Request/Answer and
         PANA-Bind-Request/Answer messages it indicates that separate
         NAP and ISP authentication is being performed in the
         authentication phase.  For other cases, S-flag MUST NOT be set. 

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Alper Yegin <[email-masked]>
Date: Fri, 03 Dec 2004 14:33:25 -0800

> 	     authenticate a host that responds with S=0.

So, the proposal is "PAA cannot mandate NAP authentication."
I'm fine with that. 
 
>          authenticate with either the NAP or the ISP only. When the

I think this should be "ISP only" (not "NAP or ISP"). This is the
default mode of operation in access networks today. 

set.

Alper