Subject: RE: [Pana] [issue19] Result-Code AVP values?

From: [email-masked]
Date: Tue, 7 Oct 2003 11:16:30 +0300

> -----Original Message-----
> From: ext Alper Yegin [mailto:[email-masked]]
> Sent: 06 October, 2003 19:34
> To: Forsberg Dan (NRC/Helsinki); [email-masked]
> Subject: Re: [Pana] [issue19] Result-Code AVP values?
> 
> 
> > Ok. So do you want to say that realm based routing is outside
> > the scope of PANA and in error case NAS must inform PaC in some
> > other means than PANA protocol?
> 
> Yes, I'm thinking that this should be happening transparent to PANA.
> 
> > I don't mind taking this error
> > case away. Anyway, I'm curious of how 802.1X does handle this
> > case?
> 
> I think this is also an EAP question. What would be the EAP 
> behavior when
> the NAS cannot recognize the EAP client identifier?

You tell me?

- Dan

> 
> From your other message:
> > Just one more comment. The usage scenarios document chapter 3
> > (problem statement) says that the authentication agent (PAA)
> > chooses the backend authentication server based on the identity,
> > for example NAI..
> 
> If we were to expand "the authentication agent" from that 
> text, actually it
> should be the "NAS" (draft-ietf-aaa-eap) implementation which 
> needs to deal
> with AAA routing, not "PAA."
> 
> Alper
> 
> 
> 
> 
> > 
> > - Dan
> > 
> >> -----Original Message-----
> >> From: ext Alper Yegin [mailto:[email-masked]]
> >> Sent: 02 October, 2003 20:31
> >> To: Forsberg Dan (NRC/Helsinki); [email-masked]
> >> Subject: Re: [Pana] [issue19] Result-Code AVP values?
> >> 
> >> 
> >>>>>        PANA_REALM_NOT_SERVED                   3003
> >>>>>           Error code from PAA to PaC.  The network
> >> doesn't recognize
> >>>>>           the realm.
> >>>> 
> >>>> We don't have a place where PaC sends the realm information.
> >>>> So, I can't see
> >>>> where such an error would be returned to the PaC.
> >>> 
> >>> The EAP-Response/Identity contains the realm if it is required. Or
> >>> should we create a NAI AVP, that contains only the realm? Realm is
> >>> needed to route the packet to the right AAA backend. If PAA
> >>> functionality doesn't check the realm, NAS or for example 
> the local
> >>> AAA proxy will do it. But in the case of unknown realm the client
> >>> should be notified.
> >> 
> >> I should have said "We don't have a place where PaC sends the realm
> >> information in PANA." You are right that EAP client ID can
> >> have this, but
> >> than it is the responsibility of EAP or EAP method to deal
> >> with this. This
> >> error case should not leak into PANA.
> >> 
> >> Alper
> >> 
> >> 
> > 
> > _______________________________________________
> > Pana mailing list
> > [email-masked]
> > https://www1.ietf.org/mailman/listinfo/pana
> > 
> > 
> 
> 

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Alper Yegin <[email-masked]>
Date: Tue, 07 Oct 2003 10:54:32 -0700

>> the NAS cannot recognize the EAP client identifier?

I think this case would be handled by the following text from the EAP spec:

         Implementation Note: The peer MAY obtain the Identity via user
         input.  It is suggested that the authenticator retry the
         Identity Request in the case of an invalid Identity or
         authentication failure to allow for potential typos on the part
         of the user.  It is suggested that the Identity Request be
         retried a minimum of 3 times before terminating the
         authentication.  The Notification Request MAY be used to
         indicate an invalid authentication attempt prior to
         transmitting a new Identity Request (optionally, the failure
         MAY be indicated within the message of the new Identity Request
         itself).

... And finally I think the EAP authenticator would send a Failure message.

Alper

---

From: Alper Yegin <[email-masked]>
Date: Tue, 07 Oct 2003 10:54:32 -0700

Alper