Subject: RE: [Pana] [issue19] Result-Code AVP values?

From: [email-masked]
Date: Mon, 6 Oct 2003 16:06:22 +0300

Just one more comment. The usage scenarios document chapter 3 
(problem statement) says that the authentication agent (PAA) 
chooses the backend authentication server based on the identity, 
for example NAI..
- Dan

> -----Original Message-----
> From: ext [email-masked] [mailto:[email-masked]]
> Sent: 06 October, 2003 15:25
> To: [email-masked]; [email-masked]
> Subject: RE: [Pana] [issue19] Result-Code AVP values?
> 
> 
> Ok. So do you want to say that realm based routing is outside 
> the scope of PANA and in error case NAS must inform PaC in some 
> other means than PANA protocol? I don't mind taking this error 
> case away. Anyway, I'm curious of how 802.1X does handle this 
> case?
> 
> - Dan
> 
> > -----Original Message-----
> > From: ext Alper Yegin [mailto:[email-masked]]
> > Sent: 02 October, 2003 20:31
> > To: Forsberg Dan (NRC/Helsinki); [email-masked]
> > Subject: Re: [Pana] [issue19] Result-Code AVP values?
> > 
> > 
> > >>>        PANA_REALM_NOT_SERVED                   3003
> > >>>           Error code from PAA to PaC.  The network 
> > doesn't recognize
> > >>>           the realm.
> > >> 
> > >> We don't have a place where PaC sends the realm information.
> > >> So, I can't see
> > >> where such an error would be returned to the PaC.
> > > 
> > > The EAP-Response/Identity contains the realm if it is required. Or
> > > should we create a NAI AVP, that contains only the realm? Realm is
> > > needed to route the packet to the right AAA backend. If PAA
> > > functionality doesn't check the realm, NAS or for example 
> the local
> > > AAA proxy will do it. But in the case of unknown realm the client
> > > should be notified.
> > 
> > I should have said "We don't have a place where PaC sends the realm
> > information in PANA." You are right that EAP client ID can 
> > have this, but
> > than it is the responsibility of EAP or EAP method to deal 
> > with this. This
> > error case should not leak into PANA.
> > 
> > Alper
> > 
> > 
> 
> _______________________________________________
> Pana mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/pana
> 

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Julien Bournelle <[email-masked]>
Date: Tue, 7 Oct 2003 15:12:55 +0200

Hi,

> chooses the backend authentication server based on the identity, 

If we use Diameter as a backend authentication server, I guess that it
is the AAA server that say that it can't  authenticate a user from a 
particular realm.
So in this case, the PAA receives a message from the AAA server
explaining the problem. As such the PAA can respond with a Result-Code
PANA_REALM_NOT_SERVED.

Am I missing something ?

-- 
[email-masked]

---

From: Julien Bournelle <[email-masked]>
Date: Tue, 7 Oct 2003 15:12:55 +0200

Hi,

Am I missing something ?