Subject: RE: [Pana] [issue19] Result-Code AVP values?

From: [email-masked]
Date: Wed, 8 Oct 2003 09:27:58 +0300

In PANA we retransmit requests because we want to have reliable 
transport. So, the case where the authenticator retransmits the 
EAP-Request/Identity is interpreted differently in PANA layer 
(retransmissions for reliability).

The case of Notification Request is usable, but what does 
"invalid authentication attempt" mean? Can we interpret it such 
a way that it means "typo in the identity, user part" or "user 
not recognized" or "realm not served"..

A result code in PANA for this (borrowed from Diameter) is clear
and works if the authenticator implementation doesn't support 
this MAY part of the EAP doc.

- Dan

> -----Original Message-----
> From: ext Alper Yegin [mailto:[email-masked]]
> Sent: 07 October, 2003 20:55
> To: Forsberg Dan (NRC/Helsinki); [email-masked]
> Subject: Re: [Pana] [issue19] Result-Code AVP values?
> 
> 
> >> I think this is also an EAP question. What would be the EAP
> >> behavior when
> >> the NAS cannot recognize the EAP client identifier?
> 
> I think this case would be handled by the following text from 
> the EAP spec:
> 
>          Implementation Note: The peer MAY obtain the 
> Identity via user
>          input.  It is suggested that the authenticator retry the
>          Identity Request in the case of an invalid Identity or
>          authentication failure to allow for potential typos 
> on the part
>          of the user.  It is suggested that the Identity Request be
>          retried a minimum of 3 times before terminating the
>          authentication.  The Notification Request MAY be used to
>          indicate an invalid authentication attempt prior to
>          transmitting a new Identity Request (optionally, the failure
>          MAY be indicated within the message of the new 
> Identity Request
>          itself).
> 
> ... And finally I think the EAP authenticator would send a 
> Failure message.
> 
> Alper
> 
> 
> 

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Alper Yegin <[email-masked]>
Date: Mon, 13 Oct 2003 22:54:03 -0700

> not recognized" or "realm not served"..

Good points, but that does not mean they are problems for PANA to solve.

Generally I'm concerned about leaking EAP-layer events or actions into PANA.
But I think in this case, this is more of mapping an EAP lower-layer
(Diameter) event to PANA. While I wouldn't simply import all such events
from one to another, I think this one might be useful and not disruptive. On
the other hand, this error message is different from all the others. Those
are all PANA-specific.

Hmmm... Does anyone else care to comment on this?

Alper

---

From: Alper Yegin <[email-masked]>
Date: Mon, 13 Oct 2003 22:54:03 -0700

Alper

---

From: Yoshihiro Ohba <[email-masked]>
Date: Tue, 14 Oct 2003 11:03:11 -0700

There are already three authentication results defined, i.e.,
PANA_SUCCESS, PANA_AUTHENTICATION_REJECTED and
PANA_AUTHORIZATION_REJECTED.  Defining a more detailed result code
PANA_REALM_NOT_SERVED seems to be a bit inconsistent in design with
those three fundamental results.

In addition, the EAP state machine draft does not have an interface to
AAA to obtain detailed error information like REALM_NOT_SERVED, and
thus in actual implementations it is likely that
PANA_AUTHENTICATION_REJECTED is used instead of PANA_REALM_NOT_SERVED.

So, my opinion is we don't need to define PANA_REALM_NOT_SERVED.

Yoshihiro Ohba

---

From: Yoshihiro Ohba <[email-masked]>
Date: Tue, 14 Oct 2003 11:03:11 -0700

Yoshihiro Ohba