Subject: [eap] EAP Success/Failure: authentication or access control result?

From: [email-masked] ([email-masked])
Date: Mon, 31 Mar 2003 11:12:03 +0300

Hi,

We had a conference call with John Vollbrecht and Nick Petroni
on Friday, and a couple of issues needing clarification came up.
Here's one of them (which seems to be related to several other
issues that came up, so let's deal with this one first).

  Does EAP Success (Failure) message mean that "I've (not)
  succesfully authenticated you" or "I'm allowing (denying)
  access"? That is, is it the authentication result or access
  control result?

In both 2284bis and 2869bis, it's always called authentication
result (e.g. 2284bis: "authentication conversation can continue
until the authenticator determines that successful
authentication has occurred, in which case the authenticator
MUST transmit an EAP Success"). 2284bis also mentions the
possibility of allowing access even though authentication=20
failed (in 7.9, "Implementation idiosyncrasies").

However, there are some parts in both documents that are not so
clear, and make more sense if you assume that it really should
be called access control result (or that the server has a policy
where the two are always the same). Note that RADIUS, for
instance, is quite clear about this: Access-Accept and Reject
are access control decisions, not authentication (and the two
don't have to be the same).
=20
What do others think, which should it be?

(Although the "authentication result" seems more obvious, it has
some interesting consequences: for instance, the client should
then probably treat both EAP Success and Failure packets as
simply "EAP conversation ended" indication, and decide whether
to continue the link solely based on its local policy, even if
Failure was received).

Best regards,
Pasi