Subject: (radius) (RADIUS) Access-Challenge packets

From: Justin McCann <[email-masked]>
Date: Tue, 16 Feb 1999 11:19:03 -0500

I have been reading and re-reading RFC2138, trying to understand just
how the Access-Challenge packets work. Could someone please comment on
and/or correct my understanding? 

(Jumping right into the middle of the authentication...)
a. Having received an Access-Request packet, the RADIUS server, for
whatever reason (interaction with SecurID server, whatever) decides to
send an Access-Challenge packet to the NAS.

b. The Access-Challenge packet MAY contain any combination of the
following two attributes (one, both, or legally none):
   --a single 'State' value, which could be the cryptographic seed the
user enters into his crypto device to generate a new password, or could
just be some variable to hold state
   --a single 'Reply-Message' value, which could contain the
cryptographic seed, and should be displayed to the user.

c. The NAS passes on the info to the dial-in client, which displays it
to the user, who enters the seed into the crypto device they have, and
types in a response, which is sent to the NAS.

d. The NAS creates a new Access-Request packet, one that contains the
'State' value, if there was one.

Thanks,
   Justin
-- 
------------------------------------------------------------
Justin McCann                        560 Chestershire
KarlNet, Inc.                        Columbus, OH 43204
email: [email-masked]            614.308.9354 (H)
                                     614.789.0511 (W)
-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.

---

From: Aydin Edguer <[email-masked]>
Date: Tue, 16 Feb 1999 11:29:30 -0500 (EST)

> just be some variable to hold state

No, the "State" value is never displayed to the user and the NAS should
not attempt to interpet the "State".  The purpose of the "State" attribute
is to allow the RADIUS Server to match the Access-Challenge to the
Access-Request that the NAS generates in response to the challenge.
It is only the RADIUS server state.

> cryptographic seed, and should be displayed to the user.

There can be one or more Reply-Message attributes that contain the
text that should be displayed to the user.

The Access-Challenge can be used for many more purposes than just
a token-card or crypto device.  It can be used just as part of a menu
system (Livingston and other RADIUS servers support this).
-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.