Subject: [eap] EAP Success/Failure: authentication or access control result?

From: [email-masked] (Alper Yegin)
Date: Tue, 15 Apr 2003 18:17:55 -0700

I'd recommend we interpret EAP result as strictly for "authentication", and
leave the "authorization" result to the EAP transport (e.g., 802.1x, PANA,
PPP). I don't know if 802.1x and PPP can handle this, but PANA can. PANA has
its own message type "PANA Success/Failure". This separation provides
greater flexibility and better division of labor, imo.

Alper

On 3/31/03 12:12 AM, "[email-masked]" <[email-masked]> wrote:

> Hi,
> 
> We had a conference call with John Vollbrecht and Nick Petroni
> on Friday, and a couple of issues needing clarification came up.
> Here's one of them (which seems to be related to several other
> issues that came up, so let's deal with this one first).
> 
> Does EAP Success (Failure) message mean that "I've (not)
> succesfully authenticated you" or "I'm allowing (denying)
> access"? That is, is it the authentication result or access
> control result?
> 
> In both 2284bis and 2869bis, it's always called authentication
> result (e.g. 2284bis: "authentication conversation can continue
> until the authenticator determines that successful
> authentication has occurred, in which case the authenticator
> MUST transmit an EAP Success"). 2284bis also mentions the
> possibility of allowing access even though authentication
> failed (in 7.9, "Implementation idiosyncrasies").
> 
> However, there are some parts in both documents that are not so
> clear, and make more sense if you assume that it really should
> be called access control result (or that the server has a policy
> where the two are always the same). Note that RADIUS, for
> instance, is quite clear about this: Access-Accept and Reject
> are access control decisions, not authentication (and the two
> don't have to be the same).
> 
> What do others think, which should it be?
> 
> (Although the "authentication result" seems more obvious, it has
> some interesting consequences: for instance, the client should
> then probably treat both EAP Success and Failure packets as
> simply "EAP conversation ended" indication, and decide whether
> to continue the link solely based on its local policy, even if
> Failure was received).
> 
> Best regards,
> Pasi
> _______________________________________________
> eap mailing list
> [email-masked]
> http://mail.frascone.com/mailman/listinfo/eap
> 
>