Subject: [AAA-WG]: Wrapping up Diameter EAP...

From: <[email-masked]>
Date: Wed, 12 May 2004 11:45:31 +0300

Hi,

I've posted an intermediate version of draft-ietf-aaa-eap-06.a
at http://www.cs.hut.fi/~peronen/eap/diameter_eap.html 
together with a HTML diff from version -05.

This is supposed to resolve all remaining open issues, but 
I would encourage everyone to check if they are OK with
the changes. 

If I don't get any complaints, I'll post this as -06 some time
next week and ask the WG chairs to send it to the IESG.

Best regards,
Pasi

---

From: Bernard Aboba <[email-masked]>
Date: Wed, 12 May 2004 07:45:17 -0700 (PDT)

A question:

RFC 3579 requires that a RADIUS client be able to differentiate one EAP
session from another.  As we've been discussing in EAP WG, this may be
tricky in the case where an EAP authentication is restarted via an
EAPOL-Start message.

I don't see any text in this draft equivalent to RFC 3579, Section 2.6.1
that describe how Diameter handles this problem.  I suspect that Diameter
should be able to do better than RADIUS, but guidance on how the server
should behave would be helpful.

---

From: Jari Arkko <[email-masked]>
Date: Wed, 12 May 2004 17:46:50 +0300

Yes. How about making the same statement as in RFC 3579,
but add Session-Id AVP in there as well?

--Jari

---

From: Bernard Aboba <[email-masked]>
Date: Wed, 12 May 2004 08:13:42 -0700 (PDT)

> but add Session-Id AVP in there as well?

In addition, I think you'd need to be clear that the Session-Id AVP would
need to change if the session were restarted, and that the Diameter server
should consider it a different session as a result.

I think the same thing would also apply to a reauthentication, no?

---

From: Jari Arkko <[email-masked]>
Date: Wed, 12 May 2004 18:32:41 +0300

> should consider it a different session as a result.

Yes.

> I think the same thing would also apply to a reauthentication, no?

Hmm... I suppose it would have to, otherwise it would be hard to distinguish
an aborted and continued reauthentication from each other? Though I don't even
know if EAP lower layers would support something like an aborted
reauthentication...

In any case, I was under the impression that in reauthentication, Diameter
would require the same session-id. But I might remember it wrong.

--Jari

---

From: Jari Arkko <[email-masked]>
Date: Wed, 12 May 2004 18:33:39 +0300

> I think the same thing would also apply to a reauthentication, no?

Also, we could invent a completely new AVP that fixes the issue
for both Diameter *and* RADIUS.

--Jari

---

From: Yoshihiro Ohba <[email-masked]>
Date: Wed, 12 May 2004 09:13:55 -0700

> should behave would be helpful.

Hmm, what is the exact definition of EAP session?

In section 4.1 of draft-ietf-eap-rfc2284bis-09.txt:

      "Since the Identifier space is unique to each session,
      authenticators are not restricted to only 256 simultaneous
      authentication conversations.  Similarly, with re-authentication,
      an EAP conversation might continue over a long period of time, and
      is not limited to only 256 roundtrips."

This text seems to indicate that an EAP session can span over multiple
rounds of re-authentication, and I don't think session identification
attributes do not have to change when reset or re-authentication
occurs.

Yoshihiro Ohba