Subject: RE: [Pana] Issue 31

From: [email-masked]
Date: Wed, 1 Oct 2003 16:02:56 +0300

Text proposal for issue8 includes a statement: "PAA SHOULD initiate 
EAP authentication before the current session lifetime expires.".

I suggest that we include this also to the section "4.4 
Re-authentication".

Change to:

   When a PaC wants to initiate EAP-based re-authentication, it sends
   a unicast PANA-PAA-Discovery message to the PAA.  This message MUST
   contain a Session-Id AVP which is used for identifying the PANA
   session on the PAA. If the PAA already has an established PANA
   session for the PaC with the matching identifier, it sends a
   PANA-Auth-Request message containing the same identifier to start
   an authentication phase.  If the PAA can not recognize the session
   identifier, it proceeds with regular authentication by sending back
   PANA-Start-Request.  When the PAA initiates EAP-based
   re-authentication, it sends a PANA-Auth-Request message containing
   the session identifier for the PaC to enter an authentication
   phase. PAA SHOULD initiate EAP authentication before the current
   session lifetime expires.

- Dan

> -----Original Message-----
> From: ext [email-masked] [mailto:[email-masked]]
> Sent: 01 October, 2003 15:41
> To: [email-masked]; [email-masked]
> Subject: RE: [Pana] Issue 31
> 
> 
> This is a good change. AAA sessions are not EAP level. I 
> still think that clarified text is required.
> 
> - Dan
> 
> > -----Original Message-----
> > From: ext Alper Yegin [mailto:[email-masked]]
> > Sent: 01 October, 2003 02:16
> > To: [email-masked]
> > Subject: [Pana] Issue 31
> > 
> > 
> > http://danforsberg.info:8080/pana-issues/issue31
> > 
> > I think the current text is sufficient... EAP-level exchanges 
> > are always
> > initiated by the authenticator/AS by EAP design.
> > 
> > On the other hand, I propose we rely on session id instead of 
> > device id in
> > order to identify a PaC requesting another round of EAP 
> > authentication.
> > 
> > Change from:
> > 
> >    When a PaC initiates EAP-based re-authentication, it
> >    sends a PANA-PAA-Discovery message to the PAA.  If the 
> PAA already
> >    has an established PANA session for the PaC with a device 
> > identifier
> >    that matches the one extracted from the MAC header 
> and/or IP header
> >    of the PANA-PAA-Discover message, it sends a PANA-Auth-Request
> >    message with the session identifier for that PANA 
> session to start
> >    an authentication phase.  When the PAA initiates EAP-based re-
> >    authentication, it sends a PANA-Auth-Request message with the
> >    session identifier for the PaC to enter an authentication phase.
> > 
> > To:
> > 
> >    When a PaC wants to initiate EAP-based re-authentication, it
> >    sends a unicast PANA-PAA-Discovery message to the PAA. 
> > This message MUST
> >    contain a Session-Id AVP which is used for identifying the 
> > PANA session
> >    on the PAA. If the PAA already has an established PANA 
> > session for the
> >    PaC with the matching identifier, it sends a PANA-Auth-Request
> >    message containing the same identifier to start an authentication
> >    phase. If the PAA cannot recognize the session identifier, 
> > it proceeds
> >    with regular authentication by sending back PANA-Start-Request.
> >    When the PAA initiates EAP-based re-authentication, it sends a
> >    PANA-Auth-Request message containing the session 
> > identifier for the PaC
> >    to enter an authentication phase.
> > 
> > Comments welcome.
> > 
> > Alper
> > 
> > 
> > _______________________________________________
> > Pana mailing list
> > [email-masked]
> > https://www1.ietf.org/mailman/listinfo/pana
> > 
> 
> _______________________________________________
> Pana mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/pana
> 

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana