Subject: [eap] issue 121 (meaning of successful authentication)

From: [email-masked] (Jari Arkko)
Date: Sun, 01 Jun 2003 20:47:18 +0300

Alper Yegin wrote:

>>We appear to have consensus that the various different
>>indications should agree.
> 
> 
> I think we should agree on the semantics of each one of these "indications".
> Do they all mean "authentication", or all "authorization", or a static mix
> of both, or a dynamic mix of both (e.g., method indication may mean auth or
> authz, depending on the method)? Once we separate which ones mean what, then
> yes, the same types should all agree.

This a part of the problem: there's a number of inputs
to the process (auth & authz), but we do not always
have multiple outputs. For instance, with a non-mutually
authenticating method, we only have the Success/Failure to
work with. So, we may not always be able to give full
information to the peer about the reason of the failure.
Furthermore, the same indication has to be used for multiple
purposes in this case. This leads me to think that its
better to documents what the inputs are to the process, but
keep the outputs the same.

Of course, if specific methods have informative messages
(as in EAP TLS), those can tell more.

--Jari