Subject: RE: [Pana] [issue113] Proposed text, solicitataion for comments.

From: [email-masked]
Date: Wed, 1 Dec 2004 10:37:39 +0200

Hi Avi,

The text is getting better, but I think that there is an implicit
authorization phase. PANA has a result code that reflects this:

   PANA_AUTHORIZATION_REJECTED             5003

      The authorization process failed.  This error could occur when
      authorization is rejected by a AAA proxy or rejected locally by a
      PAA, even if the authentication procedure succeeds.

The succesful authentication phase doesn't mean successful
authorization. PANA_AUTHORIZATION_REJECTED may be a result of
administrative reasons, network access restrictions, credit control
etc. How about this:

Original text:

   o  Authentication phase: Immediately following the handshake phase is
      the EAP execution between the PAA and PaC.  The EAP payloads
      (which carry an EAP method inside) is what is used for
      authentication.  Authentication phase may involve execution of two
      EAP sessions back-to-back, one for the NAP and one for the ISP.

   o  Authorization phase: Following a successful PANA authentication
      phase, the PaC gains access to the network and can send and
      receive IP data traffic through EP.  During this phase, the PaC
      and PAA may optionally ping each other to test liveness of the
      PANA session on each end.
 
Change to:

   o  Authentication and authorization phase: Immediately following
      the handshake phase is the EAP execution between the PAA and
      PaC.  The EAP payloads (which carry an EAP method inside) is
      what is used for authentication.  Authorization happens outside
      PANA and the result is delivered for PAA.  Authentication phase
      may involve execution of two EAP sessions back-to-back, one for
      the NAP and one for the ISP.

   o  Access phase: After a successful authentication and
      authorization the host gains access to the network and can send
      and receive IP data traffic through the EP(s).  At any time
      during this phase, the PaC and PAA may optionally ping each
      other to test liveness of the PANA session on each end.

Br,
- Dan

> -----Original Message-----
> From: ext Avi Lior [mailto:[email-masked]]
> Sent: 30 November, 2004 18:56
> To: Forsberg Dan (Nokia-NRC/Helsinki); Avi Lior; [email-masked]
> Subject: RE: [Pana] [issue113] Proposed text, solicitataion for
> comments.
> 
> 
> I have no problem with that authorization happens at the same time as
> authentication.  
> 
> There is no authorization phase. There is an authentication 
> phase which
> includes authorization.  So lets say that.
> 
> Currently the proposed change is wrong:
> 
>  "o  Authorization phase: Authorization takes place after a
> > > >        successful EAP authentication.  If authorization 
> > is succesful
> > > >        PaC and PAA establish a PANA session and PaC gains 
> > access to
> > > >        the network through EP(s). "
> 
> Original text:
> 
>  o  Authentication phase: Immediately following the handshake phase is
>       the EAP execution between the PAA and PaC.  The EAP payloads
>       (which carry an EAP method inside) is what is used for
>       authentication.  Authentication phase may involve 
> execution of two
>       EAP sessions back-to-back, one for the NAP and one for the ISP.
> 
>    o  Authorization phase: Following a successful PANA authentication
>       phase, the PaC gains access to the network and can send and
>       receive IP data traffic through EP.  During this phase, the PaC
>       and PAA may optionally ping each other to test liveness of the
>       PANA session on each end.
>  
> Change to:
> 
> o     Authentication phase: Immediately following the 
> handshake phase is
>       the EAP execution between the PAA and PaC.  The EAP payloads
>       (which carry an EAP method inside) is what is used for
>       authentication.  Authentication phase may involve 
> execution of two
>       EAP sessions back-to-back, one for the NAP and one for 
> the ISP. At the
> end of a successful Authentication phase the host will be 
> authorized to
> access the network and the Access Phase commences. 
> 
> Access Phase: After a successful authentication the host 
> gains access to the
> network and can send and receive IP data traffic through the 
> EP.  At any
> time during this phase, the PaC and PAA may optionally ping 
> each other to
> test liveness of the PANA session on each end.
> 
> 
> 
> > -----Original Message-----
> > From: [email-masked] [mailto:[email-masked]] 
> > Sent: Tuesday, November 30, 2004 2:41 AM
> > To: [email-masked]; [email-masked]
> > Subject: RE: [Pana] [issue113] Proposed text, solicitataion 
> > for comments.
> > 
> > 
> > I think the authorization happens at the same time as the 
> > authentication, because PANA itself doesn't do any policy 
> > control etc. for authorization. 
> > 
> > In case of AAA backend in use, the Result-Code AVP tells the 
> > result of the authorization as well.
> > 
> > Implicitly there is authorization, or should we say that the 
> > PANA "rule" is authorize authenticated PaCs.
> > 
> > Any proposal for improvement?
> > 
> > - Dan
> > 
> > > -----Original Message-----
> > > From: ext Avi Lior [mailto:[email-masked]]
> > > Sent: 29 November, 2004 16:55
> > > To: Forsberg Dan (Nokia-NRC/Helsinki); [email-masked]
> > > Subject: RE: [Pana] [issue113] Proposed text, solicitataion for 
> > > comments.
> > > 
> > > 
> > > "If Authorization is successful..."
> > > 
> > > How do we do authorization in PANA?
> > > Is it really the PaC that gains access to the network through
> > > the EP(s) or
> > > the device where the Pac resides?
> > > 
> > > > -----Original Message-----
> > > > From: [email-masked] [mailto:[email-masked]]
> > > > Sent: November 29, 2004 8:04 AM
> > > > To: [email-masked]
> > > > Subject: [Pana] [issue113] Proposed text, solicitataion for 
> > > comments.
> > > > 
> > > > 
> > > > Solicitation for comments, if any.
> > > > - Dan
> > > > 
> > > > http://danforsberg.info:8080/pana-issues/issue113
> > > > Dan:
> > > > 
> > > > Change from:
> > > > 
> > > >    "o  Authorization phase: Following a successful PANA
> > > authentication
> > > >        phase, the PaC gains access to the network and 
> can send and
> > > >        receive IP data traffic through EP. "
> > > > 
> > > > To:
> > > > 
> > > >    "o  Authorization phase: Authorization takes place after a
> > > >        successful EAP authentication.  If authorization 
> > is succesful
> > > >        PaC and PAA establish a PANA session and PaC gains 
> > access to
> > > >        the network through EP(s). "
> > > > 
> > > > _______________________________________________
> > > > Pana mailing list
> > > > [email-masked]
> > > > https://www1.ietf.org/mailman/listinfo/pana
> > > > 
> > > 
> > 
> > 
> > 
> 

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Avi Lior <[email-masked]>
Date: Wed, 1 Dec 2004 11:35:50 -0500

Okay,  just one thing to note if indeed we call it access phase we would
have to go through the document making that fix.

I agree that there is an Authentication/Authorization phase.  And more
acurately, that this phase consists of one or more Authentication steps and
the delivary of authorization attributes (typically during the last
authorization step).

In AAA you get an Access-Reject even when authentication succeeded but you
are not authorized to do what you want, or you don't have anymore money
etc....

The text is moving in that direction.

See more comments in line.

That result code is delivered to the PaC.
> Sent: Wednesday, December 01, 2004 3:38 AM
> The text is getting better, but I think that there is an 
> implicit authorization phase. PANA has a result code that 
> reflects this:
> 

BTW this should be "rejected by the AAA". Motivation its not just the AAA
proxy that may reject this.
 
> administrative reasons, network access restrictions, credit 
> control etc. How about this: 
> 
> Original text:
> 

In the above par.  Change "result is delivered for PAA" to "result is
delivered to the PAA"

You may also want to include that the Authentication/Authoriztion phase may
deliver authorization attributes.
 
> > > > Is it really the PaC that gains access to the network 
> through the 
> > > > EP(s) or the device where the Pac resides?
> > > > 
> > > > > [email-masked] https://www1.ietf.org/mailman/listinfo/pana
> > > > > 
> > > > 
> > > 
> > > 
> > > 
> > 
> 
> 
>

---

From: [email-masked]
Date: Wed, 8 Dec 2004 10:39:27 +0200

I agree. This is good.
- Dan

> From: ext Alper Yegin [mailto:[email-masked]]
> Sent: 07 December, 2004 21:45
> To: Forsberg Dan (Nokia-NRC/Helsinki); [email-masked];
> [email-masked]
> >        PANA and the result, optionally with authorization 
> attributes,
> >        is delivered to the PAA. Authentication phase may involve
> >        execution of two EAP sessions back-to-back, one for 
> the NAP and
> >        one for the ISP.
> 
> 
> I find saying "Authorization happens outside PANA" confusing. Because:
> - The "authorization" happens partially on the AS (AAA home) and
> partially on the NAS.
> - The "authorization result" is carried from AS to NAS by RADIUS, from
> NAS to client by PANA. (PANA-Bind-Request not only says the PaC is
> authentic, but it also conveys the PaC is allowed to access 
> the network
> access service).
> 
> I think it is safe to say this:
> 
>         PaC.  The EAP payload (which carry an EAP method inside) is
>         what is used for authentication. PAA conveys the result of
>         authentication and authorization to PaC at the end of this
> phase.
>         This phase may involve execution of two EAP sessions
> back-to-back, 
>         one for the NAP and one for the ISP.
> 
> 
> Alper
> 
> 
> 
>