Subject: [AAA-WG]: RE: Proposed resolution of EAP issue 461: Alternate Uses and Conflicting AVPs

From: <[email-masked]>
Date: Fri, 2 Apr 2004 14:08:54 +0300

Joseph Salowey wrote:

> [Joe] Not all lower layers behave consistently.  Perhaps we
> need to better describe the potential problems with how the
> lower layers behave and make recommendation upon that.  I
> included a modification to text below also including EAP
> message modification text that aligns more closely with 3579.
> 

>    "A Diameter-EAP-Answer message containing an EAP-Payload of
>    type EAP-Success or EAP-Failure MUST NOT have the Result-Code
>    AVP set to DIAMETER_MULTI_ROUND_AUTH.  
> 
>    When used with lower layers that treat authentication as 
>    sufficient for authorization the Result-Code should match 
>    the contained EAP packet: a successful Result-Code
>    for EAP-Success, and a failure Result-Code for 
>    EAP-Failure. In this case 
>    when the encapsulated EAP packet does not match the result
>    implied by the Result-Code AVP, the combination is likely to
>    cause confusion, because the NAS and peer will arrive at
>    different conclusions as to the outcome of the
>    authentication. For example, if the NAS receives a failure
>    Result-Code with an encapsulated EAP Success, it will not
>    grant access to the peer.  However, on receiving the EAP
>    Success, the peer will be lead to believe that it
>    authenticated successfully.
> 
>    This situation can be difficult to avoid when Diameter proxy
>    agents make authorization decisions (that is, proxies can
>    change the Result-Code AVP sent by the home server), or when
>    Diameter is used for communicating with a backend
>    authentication server (see Section 2.8.5).  Since the 
>    responsibility for avoiding conflicts lies with the Diameter
>    server, the NAS MUST NOT "manufacture" EAP result packets 
>    in order to correct contradictory messages that it receives.  
>    This behavior, originally mandated within [IEEE8021X], 
>    will be deprecated in the future."  

Looks good! Maybe the 2nd paragraph could be still
clarified, since EAP Success also includes some 
authorization aspects. How about this?

   "Some lower layers assume that the authorization decision is
   made by the EAP server, and thus the peer considers EAP
   Success as an indication that access was granted. In this
   case, the Result-Code SHOULD match the contained EAP packet:
   a successful Result-Code for EAP-Success, and a failure
   Result-Code for EAP-Failure. If the encapsulated EAP packet
   does not match the result implied by the Result-Code AVP, the
   combination is likely to cause confusion, because the NAS and
   peer will arrive at different conclusions as to the outcome
   of the authentication. For example, if the NAS receives a
   failure Result-Code with an encapsulated EAP Success, it will
   not grant access to the peer.  However, on receiving the EAP
   Success, the peer will be lead to believe that access was
   granted."

Cheers,
Pasi

---

From: "Joseph Salowey" <[email-masked]>
Date: Fri, 2 Apr 2004 08:01:16 -0800

[email-masked] wrote:
> Joseph Salowey wrote:
> 
>> [Joe] Not all lower layers behave consistently.  Perhaps we need to
>> better describe the potential problems with how the lower layers
>> behave and make recommendation upon that.  I included a modification
>> to text below also including EAP message modification text that
>> aligns more closely with 3579. 
>> 
> 

[Joe] I think this looks good.