Subject: [eap] Issue 100: User-Name in Access-Challenge and Access-Reject

From: [email-masked] (Jo Hermans)
Date: Wed, 26 Mar 2003 12:03:44 +0100

See my original mail at
http://mail.frascone.com/pipermail/public/eap/2003-March/000953.html and
Bernard's reply at
http://mail.frascone.com/pipermail/public/eap/2003-March/000954.html

---------------------------------------------------------------

Issue 100: User-Name in Access-Challenge and Access-Reject
Submitter name: Jo Hermans
Submitter email address: [email-masked]
Date first submitted: March 26, 2003
Reference:
http://mail.frascone.com/pipermail/public/eap/2003-March/000954.html
Document: Document Requiring change RFC 2869bis
Comment type: Technical
Priority: S
Section: 2.1
Rationale/Explanation of issue:

Paragraph 2.1 (Protocol Overview) mentions the attributes that should be
present in  acces-challenges and access-rejects :

>The NAS-Port or NAS-Port-Id attributes SHOULD be included by the NAS in
>the Access-Request packet, and either NAS-Identifier or NAS-IP-Address
>attributes MUST be included.  In order to permit forwarding of the
>Access-Reply by EAP-unaware proxies, if a User-Name attribute was
>included in an Access-Request, the RADIUS server MUST include the User-
>Name attribute in subsequent Access-Challenge, Access-Accept or Access-
>Reject packets. Without the User-Name attribute, accounting and billing
>becomes difficult to manage.  If the identity is determined by another
>means, such as the Calling-Station-Id, the NAS MUST include these
>identifying attributes in every Access-Request, and the RADIUS server
>MUST copy these identifying attributes into subsequent Access-Challenge,
>Access-Accept or Access-Reject packets.
>
But table 3.3 doesn't allow User-Name in access-challenges and
access-rejects. That would be in violation of RFC2865 too.

>Request   Accept   Reject   Challenge   #    Attribute
>0-1       0-1      0        0            1   User-Name
>  
>
Requested change:

Either change paragraph 2.1 to :

The NAS-Port or NAS-Port-Id attributes SHOULD be included by the NAS in
the Access-Request packet, and either NAS-Identifier or NAS-IP-Address
attributes MUST be included.  In order to permit forwarding of the
Access-Reply by EAP-unaware proxies, if a User-Name attribute was
included in an Access-Request, the RADIUS Server MUST include the
User-Name attribute in subsequent Access-Accept packets. Without the
User-Name attribute, accounting and billing becomes very difficult to
manage.  If the identity is determined by another means, such as the
Calling-Station-Id, the NAS MUST include these identifying attributes in
every Access-Request, and the RADIUS server MUST copy these identifying
attributes into subsequent Access-Accept packets.

or change table 3.3 to :

Request   Accept   Reject   Challenge   #    Attribute
0-1       0-1      0-1      0-1          1   User-Name

-- 
Jo Hermans

There are 10 types of people in this world, those who can count in 
binary and those who can't.