Subject: RE: [Pana] Issue150: PAA mandating separate authentication

From: Avi Lior <[email-masked]>
Date: Mon, 6 Dec 2004 15:49:49 -0500

Hmmmmm,  I don't get it.  If the PAA doesn't get to mandate NAP
authentication then why have it in the first place?

Either get rid of NAP authentication or make it enforceable by the PAA.

> -----Original Message-----
> From: Alper Yegin [mailto:[email-masked]] 
> Sent: Friday, December 03, 2004 5:33 PM
> To: [email-masked]; [email-masked]
> Subject: RE: [Pana] Issue150: PAA mandating separate authentication
> 
> 
> > 	     This implies the PaC does not wish to do separate NAP and
> > 	     ISP authentication. Only NAP or only ISP authentication
> > 	     will be performed. The PAA should not refuse to
> > 	     authenticate a host that responds with S=0.
> 
> 
> So, the proposal is "PAA cannot mandate NAP authentication." 
> I'm fine with that. 
>  
> > Revised text proposal for the section on "S" bit:
> > 
> > 	S(eparate)
> > 
> > 	 When the S-flag is set in a PANA-Start-Request message it
> >          indicates that PAA is willing to offer separate NAP and ISP
> >          authentication.  When the S-flag is set in a
> PANA-Start-Answer
> >          message it indicates that the PaC accepts on performing
> >          separate NAP and ISP authentication. The PaC may 
> also respond
> >          with the S-flag not set which implies the PaC has chosen to
> >          authenticate with either the NAP or the ISP only. When the
> 
> I think this should be "ISP only" (not "NAP or ISP"). This is 
> the default mode of operation in access networks today. 
> 
> >          S-flag is set in a PANA-Auth-Request/Answer,
> >          PANA-FirstAuth-End-Request/Answer and
> >          PANA-Bind-Request/Answer messages it indicates 
> that separate
> >          NAP and ISP authentication is being performed in the
> >          authentication phase.  For other cases, S-flag MUST NOT be
> set.
> 
> Alper
> 
> 
> 
> > 
> > _______________________________________________
> > Pana mailing list
> > [email-masked]
> > https://www1.ietf.org/mailman/listinfo/pana
> 
> 
> 
> _______________________________________________
> Pana mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/pana
> 

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Alper Yegin <[email-masked]>
Date: Mon, 06 Dec 2004 15:14:22 -0800

Hi Avi,

Typically by default only ISP auth/authz is performed.
The PANA design allows PAA to "offer" additional NAP auth/authz, and
lets PaC to "accept/deny" it. What it does not do is to let PAA
"mandate" NAP auth/authz.

Alper

> From: Avi Lior [mailto:[email-masked]]
> Sent: Monday, December 06, 2004 12:50 PM
> To: Alper Yegin; [email-masked]; [email-masked]