Subject: [Ips] Initiator CHAP authentication of target?

From: "Krueger, Marjorie" <[email-masked]>
Date: Thu, 30 Sep 2004 13:08:07 -0700

If a target supplies a CHAP name <> iSCSI node name in the login
response and the initiator claims to support authentication of the
target, is it valid for the initiator to ignore the supplied CHAP name
when authenticating the target?
 
Marjorie Krueger
Networked Storage Architecture
Networked Storage Solutions
Hewlett-Packard 

_______________________________________________
Ips mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ips

---

From: William Studenmund <[email-masked]>
Date: Thu, 30 Sep 2004 15:17:10 -0700

> when authenticating the target?

What do you mean by "CHAP name <> iSCSI node name"?

I am going to guess you're asking if an initiator can ignore a CHAP 
name (CHAP_N) the target supplied earlier in the login process. If you 
mean something else, well, ignore the rest. :-)

I think the answer is either yes, or the initiator should close the 
connection.

Quoting RFC 3720, section 11.1.4:

    In the third step, the initiator MUST continue with:

       CHAP_N=<N> CHAP_R=<R>

    or, if it requires target authentication, with:

       CHAP_N=<N> CHAP_R=<R> CHAP_I=<I> CHAP_C=<C>

    If the initiator authentication fails, the target MUST answer with a
    Login reject with "Authentication Failure" status.  Otherwise, if the
    initiator required target authentication, the target MUST either
    answer with a Login reject with "Authentication Failure" or reply
    with:

       CHAP_N=<N> CHAP_R=<R>

    If target authentication fails, the initiator MUST close the
    connection.

So it'd be wrong for the target to have sent a CHAP_N earlier in the 
login.

Take care,

Bill