Subject: [AAA-WG]: [Issue] EAP Support issues

From: "Bernard Aboba" <[email-masked]>
Date: Thu, 14 Jun 2001 14:58:58 -0700

Submitter name: Bernard Aboba
Submitter email address: [email-masked]
Date first submitted: 14-June-2001
Reference:
Document: NASREQ
Comment type: T
Priority: 1
Section: 4.0
Rationale/Explanation of issue:

When using EAP, the NAS operates as a "pass through" and so NAS
behavior is determined by the Diameter message type, *not* by the
encapsulated EAP message.

For example:

a. It is not required that an Accept or Reject message contain
   an EAP-Message AVP.
b. If an EAP-Message AVP is included, it is not required that it
   correspond to the message type. For example, an EAP-Failure can
   be encapsulated within an Access-Accept, and an EAP-Success can
   be encapsulated within an Access-Reject.

To allow correct operation in these cases, the NAS behavior MUST
be determined by the Diameter message type alone. This means that a
Reject message must result in termination of the authentication
conversation, an Accept message must result in allowing
access, and a challenge results in continuing the conversation.

How the success/failure is communicated to the user is
a subject for RFC 2284 and potential updates (RFC 2284bis),
and need not concern us in specifying the Diameter behavior.

Note that there has been discussion as to whether an EAP-Success or
EAP-Failure may be encapsulated within a Challenge message. I believe
that the answer to this is NO. Reasoning:

   Success and Failure messages are not ACK'd. Therefore the client
   will not respond, and thus the NAS will not have material with
   which to send another Request, unless it manufactures something
   on its own, which goes against the "passthrough" spirit of EAP.

   Thus, from a AAA perspective, an encapsulated EAP-Success or
   Failure message ends the authentication conversation and thus
   MUST be encapsulated within a final message (Accept or Reject)

It has also been asked whether multiple EAP methods may be used
to conduct a single authentication. This is really an EAP issue,
but with respect to AAA, I believe that the answer is that it is
not possible to encapsulate multiple EAP Success or Failure messages within
a single AAA conversation, because of the above reasoning. However,
it would be possible for a AAA server to conduct a conversation of
one type, then switch to another type, and finally, to send an
EAP Success or EAP Failure message at the end, encapsulated within
an Accept or Reject.

Requested change:

PPP-specific references to be removed (EAP can be used with IEEE 802 as
well).
Text to be added to Section 4.0 articulating the above.

---

From: Pat Calhoun <[email-masked]>
Date: Fri, 15 Jun 2001 08:35:39 -0700

Bernard,

This is a new issue. Is this intended to replace issue 51? What happens to 51?

Thanks,

PatC

---

From: Bernard Aboba <[email-masked]>
Date: Fri, 15 Jun 2001 16:47:34 -0700 (PDT)

I think it replaces issue 51, no?

---

From: Pat Calhoun <[email-masked]>
Date: Mon, 18 Jun 2001 06:53:08 -0700

> I think it replaces issue 51, no?

If we can get some confirmation from Henry, I will then close 51.

Henry?

PatC