Subject: RE: Question on draft-ietf-nasreq-criteria-02.txt

From: "Bernard Aboba (Exchange)" <[email-masked]>
Date: Mon, 11 Oct 1999 18:38:37 -0700

>>It may also be a requirement that authentication and authorization be
>>sent separately. This may be more important once a session has already
>>been established, where a user has to be re-authentication and/or
>>re-authorized.

>Or authorized for a newly requested service.

I've always wondered whether this was really a AAA 
requirement, or more of a requirement of the underlying 
connection protocol. For example, for PPP one
could create an EAP-Kerberos method to achieve this goal without any
changes to existing AAA protocols, so that meeting the
requirement is trivial from the AAA point of view. However,
the issues come with respect to the access protocol. 

The basic issue here is that in
a network access situation, the client does not have full Internet
connectivity and so cannot reach the KDC directly. This may
require the device to obtain tickets on the user's behalf, so
that delegation support is required. Also, if the access protocol 
involved has limited round trips it can be tricky
to wedge all the packets in.

---

From: John Vollbrecht <[email-masked]>
Date: Tue, 12 Oct 1999 09:46:01 -0400

> to wedge all the packets in.

One issue with EAP Kerberos is that it is not inter-domain.  I am not sure
how the EAP over RADIUS would work in an interdomain situation, but it is
certainly a requirement that if it is part of the AAA protocol that it be
able to work across domains.

A second point is that reauthentication and reauthorization are done for
different reasons.  Reauthentication is done to verify that this is still
the same user.  Reauthorization is done either because new resources are to
needed to support the existing service (e.g. adding another ISDN channel to
a connection) or to verify that the current authorization is still valid.

A final comment - I think the concept of delegation is very interesting
here.  The idea of delegating the authentication to the NAS by the user.  In
other contexts, an authorization server may delegate some or all
authorization to other authorization servers.  I am not sure how to
formalize this, but it might be worth a try.