Subject: [Pana] NEW: [issue79] Authentication success but authorization failure

From: [email-masked]
Date: Mon, 26 Apr 2004 10:14:52 +0300

TmV3IHN1Ym1pc3Npb24gZnJvbSBEYW4gRm9yc2JlcmcgPGRhbi5mb3JzYmVyZ0Bub2tpYS5jb20+Og0KDQpGcm9tIFlvc2hpaGlybyBPaGJhOg0KLS0tLS0tLS0tLS0tLS0tLS0tLS0NClNob3VsZCBQQU5BIHN1cHBvcnQgdGhlIGNhc2Ugd2hlcmUgRUFQIGF1dGhlbnRpY2F0aW9uIHN1Y2NlZWRzIGJ1dCANCm5ldHdvcmsgYWNjZXNzIGF1dGhvcml6YXRpb24gZmFpbHMgZHVlIHRvLCBlLmcuLCBhdXRob3JpemF0aW9uIA0KcmVqZWN0ZWQgYnkgYSBBQUEgcHJveHkgb3IgYXV0aG9yaXphdGlvbiBsb2NhbGx5IHJlamVjdGVkIGJ5IGEgUEFBPw0KDQotLS0tLS0tLS0tDQpjYXRlZ29yeTogVGVjaG5pY2FsDQpkb2N1bWVudDogZHJhZnQtaWV0Zi1wYW5hLXBhbmEteHgudHh0DQptZXNzYWdlczogMjU3DQpub3N5OiBkZm9yc2Jlcg0KcHJpb3JpdHk6IE1heSBGaXgNCnN0YXR1czogTm8gRGlzY3Vzc2lvbg0KdGl0bGU6IEF1dGhlbnRpY2F0aW9uIHN1Y2Nlc3MgYnV0IGF1dGhvcml6YXRpb24gZmFpbHVyZQ0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NClBBTkEgSXNzdWVzIDxwYW5hX2lzc3Vlc0BkYW5mb3JzYmVyZy5pbmZvPg0KPGh0dHA6Ly9kYW5mb3JzYmVyZy5pbmZvOjgwODAvcGFuYS1pc3N1ZXMvaXNzdWU3OT4NCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQo=_______________________________________________Pana mailing [email-masked]://www1.ietf.org/mailman/listinfo/pana

---

From: Alper Yegin <[email-masked]>
Date: Tue, 27 Apr 2004 17:36:25 -0700

> From Yoshihiro Ohba:
> --------------------
> Should PANA support the case where EAP authentication succeeds but
> network access authorization fails due to, e.g., authorization
> rejected by a AAA proxy or authorization locally rejected by a PAA?

Can this be simply achieved by separating the EAP result and the
result-code AVP?

I see there are some hints to that effect (PANA_AUTHORIZATION_REJECTED),
but I think section 9.4.7 needs to be updated to make a clean
separation.

Alper

> 
> ----------
> category: Technical
> document: draft-ietf-pana-pana-xx.txt
> messages: 257
> nosy: dforsber
> priority: May Fix
> status: No Discussion
> title: Authentication success but authorization failure
> __________________________________________________
> PANA Issues <[email-masked]>
> <http://danforsberg.info:8080/pana-issues/issue79>
> __________________________________________________
> =xjvz 
> 
>  '~ff X)

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Alper Yegin <[email-masked]>
Date: Tue, 27 Apr 2004 17:36:25 -0700

Alper

---

From: Yoshihiro Ohba <[email-masked]>
Date: Tue, 27 Apr 2004 18:34:13 -0700

> Can this be simply achieved by separating the EAP result and the

I think so.  One issue is whether the PBR that carries EAP-Success
with a result-code that indicates authorization failure should be
protected or not.  Since we can expect a AAA-Key to be established
between PaC and PAA by the time when the EAP-Success is sent (this is
the case when EAP method provides protected success indication), the
PBR/PBA exchange could be protected in this case.  The difference from
the authentication and authorization success case would be that the
established key would be deleted when the PAA receives PBA in this
case.

> but I think section 9.4.7 needs to be updated to make a clean

Yes.

Yoshihiro Ohba

---

From: Yoshihiro Ohba <[email-masked]>
Date: Tue, 27 Apr 2004 18:34:13 -0700

Yes.

Yoshihiro Ohba

---

From: Alper Yegin <[email-masked]>
Date: Tue, 27 Apr 2004 23:28:21 -0700

> established key would be deleted when the PAA receives PBA in this

Makes sense.

Alper

---

From: Alper Yegin <[email-masked]>
Date: Tue, 27 Apr 2004 23:28:21 -0700

Makes sense.

Alper

---

From: Yoshihiro Ohba <[email-masked]>
Date: Thu, 29 Apr 2004 08:05:49 -0700

OK, here is suggested changes:

- Add the following paragraph in section 4.3:

   "There is a case where EAP authentication succeeds with producing an
   EAP-Success message but network access authorization fails due to,
   e.g., authorization rejected by a AAA proxy or authorization
   locally rejected by a PAA.  When this occurs, the PAA MUST send
   PANA-Bind-Request with a result code PANA_AUTHORIZATION_REJECTED.
   If a AAA-Key is established between PaC and PAA by the time when
   the EAP-Success is generated by the EAP server (this is the case
   when the EAP method provides protected success indication), the
   this PANA-Bind message exchange MUST be protected with a MAC AVP
   and with carrying a Key-Id AVP.  The AAA-Key and the PANA session
   MUST be deleted after the PANA-Bind message exchange."

In section 9.4.7.1, change:

"
9.4.7.1 Authentication Results Codes
                                                                                
   These result code values inform the PaC about the EAP authentication
   method success or failure.
                                                                                
   PANA_SUCCESS                            2001
                                                                                
      The EAP method authentication was successful (EAP-Success).
                                                                                
   PANA_AUTHENTICATION_REJECTED            4001
                                                                                
      The authentication process for the client failed (EAP-Failure).
                                                                                
   PANA_AUTHORIZATION_REJECTED             5003
                                                                                
      A request was received for which the client could not be
      authorized.  This error could occur if the service requested is
      not permitted to the client.
"

to:
                                                                                
"                                                                                
9.4.7.1 Authentication Results Codes
                                                                                
   These result code values inform the PaC about the authentication
   and authorization result.  The authentication result and
   authorization result can be different as described below, but only
   one result that corresponds to the one detected first is returned.
                                                                                
   PANA_SUCCESS                            2001
                                                                                
      Both the authentication and authorization processes are
      successful.
                                                                                
   PANA_AUTHENTICATION_REJECTED            4001
                                                                                
      The authentication process failed.  When this error is returned,
      the authorization process also fails.
                                                                                
   PANA_AUTHORIZATION_REJECTED             5003

      The authorization process failed.  This error could occur when
      authorization is rejected by a AAA proxy or rejected locally by
      a PAA, even if the authentication procedure succeeds.
"

Yoshihiro Ohba

---

From: Yoshihiro Ohba <[email-masked]>
Date: Thu, 29 Apr 2004 08:05:49 -0700

"

   PANA_SUCCESS                            2001

                                                                                

to:
                                                                                
"                                                                                

   PANA_SUCCESS                            2001

                                                                                

Yoshihiro Ohba

---

From: Alper Yegin <[email-masked]>
Date: Thu, 29 Apr 2004 11:58:34 -0700

>    when the EAP method provides protected success indication), the

"the" at the end of line should be removed.

Agreed to the rest.

Alper

---

From: Alper Yegin <[email-masked]>
Date: Thu, 29 Apr 2004 11:58:34 -0700

Agreed to the rest.

Alper