Subject: [eap] Resolution of Issue 7: Accept

From: [email-masked] (Bernard Aboba)
Date: Wed, 27 Nov 2002 17:30:55 -0800 (PST)

Issue 7: Ability to authenticate with multiple methods one after another
not specified
Submitter: Bernard Aboba
Submitter email address: [email-masked]
Date first submitted: March 2, 2002
Reference: http://www.drizzle.com/~aboba/EAP/eapissues.html#Issue 7
Document: RFC2284bis-01
Comment type: T
Priority: S
Section: 2
Rationale/Explanation of issue:

RFC 2284 does not explain how to authenticate with multiple authentication
methods one after another.

Recommended resolution:

Add the following text to section 2:

"If the Peer does not support sequences, it SHOULD
respond to the additional Request with a Nak, and no alternative method.
However, peer implementations MAY not respond at all, in which case
a timeout will result and authentication will fail. Since
the Authenticator presumably requires successful completion of
the authentication sequence in order to grant access,
authentication failure is the intended result. Therefore, it is not
necessary for the Authenticator to determine that the peer
supports sequences prior to prompting for an additional
authentication method."