Subject: RE: [Pana] [issue113] Proposed text, solicitataion for comments.

From: [email-masked]
Date: Tue, 7 Dec 2004 11:56:18 +0200

Avi,

Thanks for input. See comments and proposed changes inline below. I've
also updated the issue113 with the same text as here.

http://danforsberg.info:8080/pana-issues/issue113

> -----Original Message-----
> From: ext Avi Lior [mailto:[email-masked]]
> Sent: 01 December, 2004 18:36
> To: Forsberg Dan (Nokia-NRC/Helsinki); Avi Lior; [email-masked]
> Subject: RE: [Pana] [issue113] Proposed text, solicitataion for
> comments.
> 
> 
> Okay, just one thing to note if indeed we call it access phase we
> would have to go through the document making that fix.
>
> I agree that there is an Authentication/Authorization phase.  And
> more acurately, that this phase consists of one or more
> Authentication steps and the delivary of authorization attributes
> (typically during the last authorization step).
> 
> In AAA you get an Access-Reject even when authentication succeeded
> but you are not authorized to do what you want, or you don't have
> anymore money etc....

This is probably true for the RADIUS (Access-Reject), but Diameter has
more fine grained result codes. I think it's good to differentiate (or
at least provide the possibility for it) authentication and
authorization.

> The text is moving in that direction.
> 
> See more comments in line.
> 
> That result code is delivered to the PaC.
> > -----Original Message-----
> > From: [email-masked] [mailto:[email-masked]] 
> > Sent: Wednesday, December 01, 2004 3:38 AM
> > To: [email-masked]; [email-masked]
> > Subject: RE: [Pana] [issue113] Proposed text, solicitataion 
> > for comments.
> > 
> > 
> > Hi Avi,
> > 
> > The text is getting better, but I think that there is an implicit
> > authorization phase. PANA has a result code that reflects this:
> > 
> >    PANA_AUTHORIZATION_REJECTED             5003
> > 
> >       The authorization process failed.  This error could occur
> >       when authorization is rejected by a AAA proxy or rejected
> >       locally by a PAA, even if the authentication procedure
> >       succeeds.
> 
> BTW this should be "rejected by the AAA". Motivation its not just
> the AAA proxy that may reject this.

Ok.

Change from (07a):

   PANA_AUTHORIZATION_REJECTED             5003

      The authorization process failed.  This error could occur when
      authorization is rejected by a AAA proxy or rejected locally by
      a PAA, even if the authentication procedure succeeds.

To:

   PANA_AUTHORIZATION_REJECTED             5003

      The authorization process failed.  This error could occur when
      authorization is rejected by a AAA or locally by a PAA, even if
      the authentication procedure succeeds.

Change also section 4.3 ("AAA proxy" --> "AAA") (07a) from:

   "There is a case where EAP authentication succeeds with producing an
   EAP-Success message but network access authorization fails due to,
   e.g., authorization rejected by a AAA proxy or authorization locally
   rejected by the PAA."  

To:

   "There is a case where EAP authentication succeeds with producing
   an EAP-Success message but network access authorization fails due
   to, e.g., authorization rejected by a AAA or authorization locally
   rejected by the PAA. "

> > The succesful authentication phase doesn't mean successful
> > authorization. PANA_AUTHORIZATION_REJECTED may be a result of
> > administrative reasons, network access restrictions, credit
> > control etc. How about this:
> > 
> > Original text:
> > 
> >    o Authentication phase: Immediately following the handshake
> >    phase is the EAP execution between the PAA and PaC.  The EAP
> >    payloads (which carry an EAP method inside) is what is used for
> >    authentication.  Authentication phase may involve execution of
> >    two EAP sessions back-to-back, one for the NAP and one for the
> >    ISP.
> > 
> >    o Authorization phase: Following a successful PANA
> >    authentication phase, the PaC gains access to the network and
> >    can send and receive IP data traffic through EP.  During this
> >    phase, the PaC and PAA may optionally ping each other to test
> >    liveness of the PANA session on each end.
> >  
> > Change to:
> > 
> >    o Authentication and authorization phase: Immediately following
> >    the handshake phase is the EAP execution between the PAA and
> >    PaC.  The EAP payloads (which carry an EAP method inside) is
> >    what is used for authentication.  Authorization happens outside
> >    PANA and the result is delivered for PAA. Authentication phase
> >    may involve execution of two EAP sessions back-to-back, one for
> >    the NAP and one for the ISP.
> 
> In the above par.  Change "result is delivered for PAA" to "result
> is delivered to the PAA"
> 
> You may also want to include that the Authentication/Authoriztion
> phase may deliver authorization attributes.

Ok. 

Change from section 3 (07a) from:

   o  Authentication phase: Immediately following the handshake phase is
      the EAP execution between the PAA and PaC.  The EAP payloads
      (which carry an EAP method inside) is what is used for
      authentication.  Authentication phase may involve execution of two
      EAP sessions back-to-back, one for the NAP and one for the ISP.

   o  Authorization phase: Following a successful PANA authentication
      phase, the PaC gains access to the network and can send and
      receive IP data traffic through EP.  During this phase, the PaC
      and PAA may optionally ping each other to test liveness of the
      PANA session on each end.

   o  Re-authentication phase: Following an authorization phase, the PAA
      must initiate re-authentication before the PANA session lifetime
      expires.  Again EAP is carried by PANA to perform authentication.
      This phase may be optionally triggered by both the PaC and the PAA
      without any respect to the session lifetime.  The session moves to
      this phase from authorized phase, and returns back there upon
      successful re-authentication.

To:

    o  Authentication and authorization phase: Immediately following
       the handshake phase is the EAP execution between the PAA and
       PaC.  The EAP payloads (which carry an EAP method inside) is
       what is used for authentication.  Authorization happens outside
       PANA and the result, optionally with authorization attributes,
       is delivered to the PAA. Authentication phase may involve
       execution of two EAP sessions back-to-back, one for the NAP and
       one for the ISP.

    o  Access phase: After a successful authentication and
       authorization the host gains access to the network and can send
       and receive IP data traffic through the EP(s).  At any time
       during this phase, the PaC and PAA may optionally ping each
       other to test liveness of the PANA session on each end.

    o  Re-authentication phase: Following an access phase, the PAA
       must initiate re-authentication before the PANA session
       lifetime expires.  Again EAP is carried by PANA to perform
       authentication.  This phase may be optionally triggered by both
       the PaC and the PAA without any respect to the session
       lifetime.  The session moves to this phase from access phase,
       and returns back there upon successful re-authentication.

The rest of the changes are just changing the name of the phase.

Change part of Figure 1 (s/Authorization/Access/) (07a):

   // Authorization phase (IP data traffic allowed)
      <-----     PANA-Ping-Request
      ----->     PANA-Ping-Answer

To:

   // Access phase (IP data traffic allowed)
      <-----     PANA-Ping-Request
      ----->     PANA-Ping-Answer

Change from (07a) ("authorization phase" --> "access phase):

   4.4  Authorization Phase

   Once an authentication phase or a re-authentication phase
   successfully completes, the PaC gains access to the network and can
   send and receive IP data traffic through EP and the PANA session
   enters an authorization phase.  In this phase, PANA-Ping-Request
   and PANA-Ping-Answer messages can be used for testing the liveness
   of the PANA session on the PANA peer.  Both the PaC and the PAA are
   allowed to send a PANA-Ping-Request message to the communicating
   peer whenever they need to make sure the availability of the
   session on the peer and expect the peer to return a
   PANA-Ping-Answer message.  Both PANA-Ping-Request and
   PANA-Ping-Answer messages MUST be protected with a MAC AVP when a
   PANA SA is available.

To:

   4.4  Access Phase

   Once an authentication phase or a re-authentication phase
   successfully completes, the PaC gains access to the network and can
   send and receive IP data traffic through EP.  In this access phase,
   PANA-Ping-Request and PANA-Ping-Answer messages can be used for
   testing the liveness of the PANA session on the PANA peer.  Both
   the PaC and the PAA are allowed to send a PANA-Ping-Request message
   to the communicating peer whenever they need to make sure the
   availability of the session on the peer and expect the peer to
   return a PANA-Ping-Answer message.  Both PANA-Ping-Request and
   PANA-Ping-Answer messages MUST be protected with a MAC AVP when a
   PANA SA is available.

Change from (07a) ("auhtorization phase" --> "access phase"):

   4.5  Re-authentication Phase

   A PANA session in an authorization phase can enter a
   re-authentication phase to extend the current session lifetime by
   re-executing EAP.  Once the re-authentication phase successfully
   completes, the session re-enters the authorization phase.
   Otherwise, the session is deleted.

To:

   4.5  Re-authentication Phase

   A PANA session in an access phase can enter a re-authentication
   phase to extend the current session lifetime by re-executing EAP.
   Once the re-authentication phase successfully completes, the
   session re-enters the access phase.  Otherwise, the session is
   deleted.

Br,
- Dan

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Alper Yegin <[email-masked]>
Date: Tue, 07 Dec 2004 11:45:23 -0800

>        execution of two EAP sessions back-to-back, one for the NAP and

I find saying "Authorization happens outside PANA" confusing. Because:
- The "authorization" happens partially on the AS (AAA home) and
partially on the NAS.
- The "authorization result" is carried from AS to NAS by RADIUS, from
NAS to client by PANA. (PANA-Bind-Request not only says the PaC is
authentic, but it also conveys the PaC is allowed to access the network
access service).

I think it is safe to say this:

     o  Authentication and authorization phase: Immediately following
        the handshake phase is the EAP execution between the PAA and
        PaC.  The EAP payload (which carry an EAP method inside) is
        what is used for authentication. PAA conveys the result of
        authentication and authorization to PaC at the end of this
phase.
        This phase may involve execution of two EAP sessions
back-to-back, 
        one for the NAP and one for the ISP.

Alper