Subject: Re: [radext] rfc3579- Doubt regarding Access challenge packet

From: Bernard Aboba <[email-masked]>
Date: Thu, 24 Jan 2013 19:18:24 +0000

[BA] That text is about Access-Accept, not Access-Challenge.  An Access-Challenge is not about provisioning services (the decision on whether to Accept or Reject has not been made yet).  Given that, I believe that ignoring attributes that aren't understood is probably fine.  Even attributes that might be considered mandatory in an Accept (e.g. filters) can probably be safely ignored in an Access-Challenge. 

 

Section 2.5 of RFC 5080 says, in relevant part:

   In general, it is best for a RADIUS client to err on the side of
   caution.  On receiving an Access-Accept including an attribute of
   known Type for an unimplemented service, a RADIUS client MUST treat
   it as an Access-Reject, as directed in [RFC2865] Section 1.1.  On
   receiving an Access-Accept including an attribute of unknown Type, a
   RADIUS client SHOULD assume that it is a potential service
   definition, and treat it as an Access-Reject.  Unknown VSAs SHOULD be
   ignored by RADIUS clients.

   In order to avoid introducing changes in default behavior, existing
   implementations that do not obey this recommendation should make the
   behavior configurable, with the legacy behavior being enabled by
   default.  A configuration flag such as "treat unknown attributes as
   reject" can be exposed to the system administrator.  If the flag is
   set to true, then Access-Accepts containing unknown attributes are
   treated as Access-Rejects.  If the flag is set to false, then unknown
   attributes in Access-Accepts are silently ignored.

Regards,

Dave

David B. Nelson
Director of Technology
Elbrys Networks, Inc.
www.elbrys.com
+1.603.570.2636

---

From: Dave Nelson <[email-masked]>
Date: Thu, 24 Jan 2013 14:27:27 -0500

On Thu, Jan 24, 2013 at 2:18 PM, Bernard Aboba
<[email-masked]> wrote:

> [BA] That text is about Access-Accept, not Access-Challenge.  An
> Access-Challenge is not about provisioning services (the decision on whether
> to Accept or Reject has not been made yet).  Given that, I believe that
> ignoring attributes that aren't understood is probably fine.  Even
> attributes that might be considered mandatory in an Accept (e.g. filters)
> can probably be safely ignored in an Access-Challenge.

Agreed.

Regards,

Dave

David B. Nelson
Director of Technology
Elbrys Networks, Inc.
www.elbrys.com
+1.603.570.2636

---

From: siva kumar <[email-masked]>
Date: Fri, 25 Jan 2013 12:29:02 +0530

Hi Dave/Alan/Bernard/Others,

Thanks all for the valuable inputs. It is evident that our NAS
implementation is not acceptable as per your views. And Our NAS
is not interoperable with most of the radius servers. We will consider all
your inputs and re-architect our implementation.

Thanks again.

Regards,
Sivakumar.S

---

From: siva kumar <[email-masked]>
Date: Thu, 31 Jan 2013 12:30:22 +0530

Hi All,

I have one more question:

In case of 802.1x authentication (EAP and radius), if the radius server
sends a access-accept with a service type that
is not supported by NAS, it is recommended that the NAS assumes it to be a
access-reject, but is it OK for the NAS(which
acts as passthru) to decode the EAP success message sent in radius
access-accept message and modify it as a EAP failure
and send it to the supplicant.

Thanks & Regards,
Sivakumar.S