Subject: [eap] issue 121 (meaning of successful authentication)

From: [email-masked] (Jari Arkko)
Date: Fri, 30 May 2003 17:27:42 +0300

We are in this discussion mainly because there are
several factors that affect the final network access
allowed or not -decision: the success of the authentication
itself as well as various authorization checks related
to the authenticated identity, time of day, phase of
moon and so on. Still, these factors will result in
one decision, and that decision must be communicated
to the user. EAP in general lacks facilities for
communicating the specific reason for the failure
(or success for that matter) to the user, e.g.
authenticated/authorized bits, specific extent of
the authorization, and so on.

What further complicates the picture is that
there are EAP level indications (Success/Failure), AAA
level indications (Accept/Reject), method level indications,
and possibly some link level indications.

We appear to have consensus that the various different
indications should agree. That is, if we are going
to fail the user based on an authz decision, we should
do so at the method, EAP, and AAA layers. I agree with
this, but note that there is one case where it seems
hard to make these all agree: if it really is so that
we must be able to fail an authentication and still
provide restricted access, then it becomes very hard
for a method to show agreement if that method is
mutually authenticating and uses MICs. (Perhaps this
is not a serious concern, if this case is
documented.)

Proposed text (search for "Here at the proposed fixes")
on the issue site takes the approach of "toning down" the
meaning of authentication, but does not explicitly mention
the reasons why authentication is not exactly the same
thing as in normal terminology. I am in favor of an
explict explanation. In addition, we need text to explain
the failed auth, succeeded authz case above. Finally,
change "(e.g. where the peer may not be authorized
for reasons of policy)" to "(e.g. due to a valid user
not being authorized to get the requested service)".

--Jari

---

From: [email-masked] (Alper Yegin)
Date: Fri, 30 May 2003 18:54:05 -0700

> indications should agree.

I think we should agree on the semantics of each one of these "indications".
Do they all mean "authentication", or all "authorization", or a static mix
of both, or a dynamic mix of both (e.g., method indication may mean auth or
authz, depending on the method)? Once we separate which ones mean what, then
yes, the same types should all agree.

> That is, if we are going
> the failed auth, succeeded authz case above.

I agree to both.

Alper

> Finally,
> _______________________________________________
> eap mailing list
> [email-masked]
> http://mail.frascone.com/mailman/listinfo/eap
>