Subject: Re: [eap] Re: [802.1] Re: 802.1X interface variable

From: John Vollbrecht <[email-masked]>
Date: Fri, 09 Jan 2004 09:29:29 -0500

This is very interesting - question below -

--On Sunday, January 4, 2004 9:22 AM -0800 Bernard Aboba 
<[email-masked]> wrote:

.
.
.
.

> Proving mutual possession of the shared secret is enough to provide mutual
> authentication.  However, there is a separate issue of authorization -- if
> mutual authentication occurs, is this enough for both sides to know that
> they are authorized?  For this an authorization error message is required.
> Since authentication has occurred, this can be MAC'd. If such a message is
> supported and is not sent, then the client can know that the server will
> eventually signal Success and can silently discard EAP Failure packets.

I am not sure it is a requirement that EAP methods provide authorization as 
well as authentication.  Seems they MAY, but are not required to do so.  In 
this circumstance the presence of a key would be sufficient to indicate the 
method succeeded.  I think this is what you are implying here.

In the case where a method expects a authorization failure message then 
message is part of the method, and the method will not complete unless an 
authorization failure or succeed message is received.  EAP Success or 
Failure messages are discarded when received before a method completes. 
After a method completes unexpected  EAP Success/Fail messages will be 
discarded.

So is it the intention here that all methods should support authorization 
in addition to authentication?  I was thinking that in at least some cases 
the authorization was done by the AAA protocol and Authentication by EAP. 
Certainly authorization decisions can be based on rules between the NAS/AP 
and the AAA Server.

- John 
_______________________________________________
eap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/eap

---

From: Yoshihiro Ohba <[email-masked]>
Date: Fri, 09 Jan 2004 18:59:28 -0800

In addition to John's point, there is another issue.

Even when the authorization is performed in an EAP method and the AAA
server returns access accept with a key, it is still possible that
access is rejected by a AAA proxy when the authorization is performed
in a distributed manner.  In this case, can the peer still always
expect EAP Success after protected result indication has been
successfully made in the method?

Yoshihiro Ohba