Subject: [AAA-WG]: Question regarding aaa-EAP "Diameter-EAP-Answer (DEA) Command"

From: [email-masked]
Date: Tue, 26 Nov 2002 11:53:35 -0000

Hi, 

Aaa-EAP draft 3.2 says that 

"the EAP client has been successfully authenticated and authorized,
in which case the message MUST include the Result-Code AVP
indicating success, and SHOULD include an EAP-Payload of type EAP-
Success.  This event MUST cause the access device to provide
service to the EAP client."

I am thinking the case that the EAP client is only authenticated but not
authorized to use service, then I will use Result-Code
"DIAMETER_LIMITED_SUCCESS 2002" in the Diameter-EAP-Answer message and also
includes the EAP success payload in the message since the authentication is
successful.

When receiving such a message, the device in the access network will not
open the door to provide service to the EAP client, but the EAP client will
think I am already authorised since it gets back the EAP-Success, and starts
to send IP packets.

Would this lead to bad user experience? Do you see the need to have a new
"limited success" code for EAP as well? So that the authentication server
can use the "Limited Success" EAP payload to indicate to the EAP client that
further actions needs to be taken to be granted to the service.

Thanks  

Xin Chen
Mobile Network Architecture
Fujitsu Laboratories of Europe LTD
Tel: +44 (0) 2086064453
Mobile: +44 (0)7775741020