Subject: (radius) draft conflict

From: Barney Wolff <[email-masked]>
Date: Thu, 16 Mar 2000 17:08 EST

I believe there's a conflict between draft-ietf-radius-radius-v2-06.txt
and draft-ietf-radius-ext-07.txt.  The latter, in section 5.13, says
" A RADIUS Server not supporting EAP-Message MUST return an Access- 
      Reject if it receives an Access-Request containing an EAP-Message
      attribute."
but the former, in section 5, says
" A RADIUS server MAY ignore Attributes with an unknown Type."

These statements conflict, as a server not supporting EAP will treat
EAP-Message as an unknown attribute type.

In practice this should not be a problem, as a request containing
EAP-Message will not contain User-Password or CHAP-Password, and
is likely to be rejected anyway, but I think the wording conflict
should be resolved, by putting the requirement on the NAS instead:

"A NAS which has sent an Access-Request containing EAP-Message and
receives an Access-Accept or Access-Challenge not containing an 
EAP-Message, should treat the packet as an Access-Reject."

This choice is in accord with the principle that new features should
not retroactively require changes in nodes not supporting them.

Barney Wolff  <[email-masked]>
-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.