Subject: [Pana] A question regarding re-authentication

From: Julien Bournelle <[email-masked]>
Date: Fri, 23 Apr 2004 15:35:53 +0200

hi all,

    We consider in PANA two types of re-authentication: one based on EAP
    and the other based on PANA.

    It is written in the PANA draft that: "The PAA SHOULD initiate EAP
    authentication before the current session lifetime expires." This
    session lifetime is allocated by the AAA server (Diameter or
	    RADIUS). In Diameter EAP the server may also initiate a
    re-authentication using RAR/RAA exchange. 
  
    SO we could have a situation where both PAA and AAA server try to
    re-authenticate the PaC. Moreover, correct me if I'm wrong, I guess
    that RADIUS specification does not deal with re-authentication.

    what do you think about this ?

--    	 
[email-masked]

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Yoshihiro Ohba <[email-masked]>
Date: Tue, 27 Apr 2004 17:28:52 -0700

On Fri, Apr 23, 2004 at 03:35:53PM +0200, Julien Bournelle wrote:
>     re-authenticate the PaC. 

Yes, there could be such a situation.  However, this is not a PANA
specific problem.  It could also occur for IEEE 802.1X.  This is
basically a Diameter issue, i.e., the race condition between DER sent
from NAS and RAR sent from the AAA server.  It might be better to bring 
this issue on the AAA WG.

> Moreover, correct me if I'm wrong, I guess

RADIUS deals with re-authentication initiated by NAS or network access
client (at least RFC 3580 supports it) but it does not deals with
re-authentication initiated by the AAA server.  An extention of RADIUS
(RFC 3576) deals with re-authorization initiated by the AAA server but
still does not seem to deal with re-authentication initiated by the
AAA server.

Yoshihiro Ohba

---

From: Yoshihiro Ohba <[email-masked]>
Date: Tue, 27 Apr 2004 17:28:52 -0700

Yoshihiro Ohba