Subject: [eap] Re: is UserName required in an Access-Reject or not?

From: [email-masked] (Bernard Aboba)
Date: Thu, 13 Mar 2003 09:09:06 -0800 (PST)

Here's the text from RFC 2869:

"   In order to permit non-EAP aware RADIUS proxies to forward the
   Access-Request packet, if the NAS sends the EAP-Request/Identity, the
   NAS MUST copy the contents of the EAP-Response/Identity into the
   User-Name attribute and MUST include the EAP-Response/Identity in the
   User-Name attribute in every subsequent Access-Request. NAS-Port or
   NAS-Port-Id SHOULD be included in the attributes issued by the NAS in
   the Access-Request packet, and either NAS-Identifier or NAS-IP-
   Address MUST be included.  In order to permit forwarding of the
   Access-Reply by EAP-unaware proxies, if a User-Name attribute was
   included in an Access-Request, the RADIUS Server MUST include the
   User-Name attribute in subsequent Access-Accept packets. Without the
   User-Name attribute, accounting and billing becomes very difficult to
   manage."

In RFC 2865, it indicates that User-Name is not permitted in the
Access-Challenge or Access-Reject.

So I think the answer is that the table is correct, and the text should be
corrected to reflect the original RFC 2869 text.

Does this make sense?

> Message: 5
> Date: Thu, 13 Mar 2003 16:09:25 +0100
> From: Jo Hermans <[email-masked]>
> To: [email-masked]
> Subject: [eap] RFC2869bis-10 : is UserName required in an Access-Reject or not ?
>
> I found a type in draft10 : in section 2.1 (Protocol Overview), the
> draft mentions that a UserName attribute *must* be included in
> Access-Challenge, Access-Accept or Access-Reject packets, to help
> forwarding for EAP-unaware proxies. But in section 3.3. (Table of
> Attributes), username isn't allowed in an Access-Reject packet. Typo in
> the table ?
>
> --
> Jo Hermans
>
> There are 10 types of people in this world, those who can count in binary and those who can't.
>
>
>
>
> --__--__--
>
> _______________________________________________
> eap mailing list
> [email-masked]
> http://mail.frascone.com/mailman/listinfo/eap
>
>
> End of eap Digest
>

---

From: [email-masked] (Jo Hermans)
Date: Fri, 14 Mar 2003 17:13:26 +0100

>corrected to reflect the original RFC 2869 text.
I've never really understood by  a proxy needed to have the UserName in 
a response (Access-Challenge, Access-Accept or Access-Reject). A 
UserName can't be used to route the response back to where the request 
came from, because it's not unique. And RADIUS-proxies have handled 
those responses for years without any help.

So, yes, I think that the table is correct, and User-Names shouldn't be 
copied in responses.

-- 
Jo Hermans