Subject: RE: [Pana] EAP-Payload in PBR (new issue)

From: [email-masked]
Date: Mon, 26 Jan 2004 12:23:51 +0200

Ok. In EAP state machine the AAA timeout results as a timeout_failure. 
If PBR is used, the result-code AVP should clarify this. I coulnd't find 
any directly suitable result-code from rfc3588, though. One that is near
could be this one:

   DIAMETER_UNABLE_TO_COMPLY          5012
      This error is returned when a request is rejected for unspecified
      reasons.

=>
 
   PANA_UNABLE_TO_COMPLY		5012

This could then happen in any stage in which the EAP protocol is 
involved.

- Dan

> -----Original Message-----
> From: ext Yoshihiro Ohba [mailto:[email-masked]]
> Sent: 22 January, 2004 19:18
> To: Forsberg Dan (Nokia-NRC/Helsinki)
> Cc: [email-masked]; [email-masked]
> Subject: Re: [Pana] EAP-Payload in PBR (new issue)
> 
> 
> I thought that PANA-Error message is used for errors occured within
> PANA.  But in this case, the error is an EAP authentication failure
> and I think it should be carried by PANA authentication
> success/failure message (i.e., PBR).
> 
> (There is another problem with using PANA-Error for this case: 
> Which AVP is considered invalid and carried in Failed-AVP?)
> 
> Yoshihiro Ohba
> 
> 
> On Thu, Jan 22, 2004 at 05:36:40PM +0200, 
> [email-masked] wrote:
> > I guess an error should be sent instead then, not the PBR msg.
> > - Dan
> > 
> > > -----Original Message-----
> > > From: [email-masked] [mailto:[email-masked]]On 
> > > Behalf Of ext Yoshihiro Ohba
> > > Sent: 17 January, 2004 02:44
> > > To: [email-masked]
> > > Subject: [Pana] EAP-Payload in PBR (new issue)
> > > 
> > > 
> > > In the current PANA spec, EAP-Payload AVP is a required AVP for
> > > PANA-Bind-Request.  However, it is possible that EAP conversation
> > > fails without generating a EAP-Success or EAP-Failure message,
> > > specifically when a AAA timeout occurs (please see EAP Full
> > > Authenticator State Machine diagram in the EAP state 
> machines draft,
> > > pdf version).
> > > 
> > > Thus, EAP-Payload AVP should be optional for PANA-Bind-Request.
> > > 
> > > Yoshihiro Ohba
> > > 
> > > 
> > > _______________________________________________
> > > Pana mailing list
> > > [email-masked]
> > > https://www1.ietf.org/mailman/listinfo/pana
> > > 
> 

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 26 Jan 2004 07:28:25 -0800

> This could then happen in any stage in which the EAP protocol is 

I agree.  How about having more detailed text (please see below)?

"  PANA_UNABLE_TO_COMPLY          5012

      This error is returned when a request is rejected for
      unspecified reasons.  For example, when an EAP authentication
      fails at an EAP pass-through authenticator without passing an
      EAP-Failure message to the PAA, a Result-Code AVP with this
      error code is carried in PANA-Bind-Request message without an
      EAP-Payload AVP."
                                                                                
Regards,
 
Yoshihiro Ohba

---

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 26 Jan 2004 07:28:25 -0800

Regards,
 
Yoshihiro Ohba