Subject: [Pana] issue56: AAA routing based on NAI vs. ISP choice clarification

From: Alper Yegin <[email-masked]>
Date: Wed, 14 Apr 2004 13:55:56 -0700

This is a proposed resolution for issue 56.

Partial text is from section 4.2...

Change from:

   If the S-flag of the received PANA-Start-Request message is not set,
   PaC MUST NOT set the S-flag in the PANA-Start-Answer message sent
   back to the PAA.  In this case, PaC can indicate its choice of ISP by
   including its ISP-Information AVP in the PANA-Start-Answer message.
   AAA routing will be based on the ISP choice if an ISP-Information AVP
   is specified in the PANA-Start-Answer message, otherwise it will be
   based on EAP identifier.

   If the S-flag of the received PANA-Start-Request message is set, PaC
   can indicate its desire to perform separate EAP authentication for
   NAP and ISP by setting the S-flag in the PANA-Start-Answer message.
   In this case, PaC can also indicate its choice of ISP by including
   its ISP-Information AVP in the PANA-Start-Answer message.  AAA
   routing for NAP authentication will be based on the NAP.  AAA routing
   for ISP authentication will be based on the ISP choice if an
   ISP-Information AVP is specified in the PANA-Start-Answer message,
   otherwise it will be based on EAP identifier.  If the S-flag of the
   received PANA-Start-Request message is set and the S-flag of the
   corresponding PANA-Start-Answer message is not set, only one EAP
   authentication occurs without distinction between NAP and ISP
   authentications.  In this case, PaC can still indicate its choice of
   ISP by including its ISP-Information AVP in the PANA-Start-Answer
   message.

To:

   If the S-flag of the received PANA-Start-Request message is not set,
   PaC MUST NOT set the S-flag in the PANA-Start-Answer message sent
   back to the PAA.  In this case, PaC can indicate its choice of ISP by
   including an ISP-Information AVP in the PANA-Start-Answer message.
   When a AAA backend is used, the identity of the destination AAA
server 
   or realm MUST be determined based on the explicitly chosen ISP. When
the 
   ISP-Information AVP is not present, the access network MAY rely on
the
   client identifier carried in the EAP authentication method to make
this 
   determination.

   If the S-flag of the received PANA-Start-Request message is set, PaC
   can indicate its desire to perform separate EAP authentication for
   NAP and ISP by setting the S-flag in the PANA-Start-Answer message.
   In this case, PaC can also indicate its choice of ISP by including
   its ISP-Information AVP in the PANA-Start-Answer message. When a AAA
   backend is used, the access network determines the destination AAA
server 
   for NAP authentication. The identity of the destination AAA server or
   realm for ISP authentication is determined as described earlier. If
the
   S-flag of the received PANA-Start-Request message is set and the
S-flag 
   of the corresponding PANA-Start-Answer message is not set, only one
EAP
   authentication occurs without distinction between NAP and ISP
   authentications.  In this case, PaC can still indicate its choice of
   ISP by including its ISP-Information AVP in the PANA-Start-Answer
   message.

Comments welcome.

Alper

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana