Subject: [eap] Re: Issue 121: Documenting meaning of successful authentication

From: [email-masked] (Bernard Aboba)
Date: Wed, 7 May 2003 07:32:48 -0700 (PDT)

John Vollbrecht wrote:

"My suggestion is that we indicate strongly that the CON_ACC output of a
method MUST be followed by an EAP-Success, and that it SHOULD only be used
with protected Tunnelled methods, such as PEAP."

Assuming that the method completes successfully, the peer will be
expecting an EAP Success and will silently discard an EAP Failure. So it
does seem reasonable for the authenticator to send an EAP Success
at that point. We said "SHOULD" in RFC 2869bis because there might be some
cases where it could be acceptable for this not to happen. For example, if
the AAA server sent an Access-Reject/EAP Failure instead, the peer might
silently discard the EAP Failure, but perhaps the NAS could send a lower
layer failure indication (PPP LCP-Terminate, 802.11
Deauthenticate/Disassociate) to make sure that the peer understands that
access is not being provided.