Subject: [AAA-WG]: Issue eap: Alternate uses and conflicting AVPs

From: "Joseph Salowey" <[email-masked]>
Date: Wed, 3 Mar 2004 17:51:30 -0800

Submitter name: Joe Salowey 
Submitter email address: [email-masked] 
Date first submitted: 3/3/2004 
Reference: 
Document: eap 
Comment type: E
Priority: '1' Should fix 
Section: 2.8.2 and 2.8.5
Rationale/Explanation of issue: 

Since EAP keying has the concept of the key name this should probably be
returned along with the Master Key. 

It might be goos to provide some motivation behind the 2.8.2
recommendation. I think the basic reason is that often lower layer
protocols do not distingush between authentication and authorization.
In these protocols the EAP-Success translates to a granting of access.
If one were dealing with lower layer protocols that handled this
differently then perhaps the having conflicting AVPs in some cases might
not be so bad. 

The alternate use of using Diameter to interface to an EAP
authentication server from an authorization server introduces some
interesting behavior.  It could be possible that the authentication
succeeds and the authorization fails.  In this case it would seem that
the authorization server should turn the EAP-Payload to an EAP-Failure
to be in line with 2.8.2.  It might also be noted that this behavior
when used with certain EAP methods may cause a EAP timeout in lower
layers that expect the authorization decision to match the EAP
Authentication decision.