Subject: RE: [eap] Issue 199: Full authenticator SM issue

From: "Ashwin Palekar" <[email-masked]>
Date: Wed, 12 Nov 2003 09:22:00 -0800

This is the case where EAP is forwarded to first RADIUS server; which
tries to negotiate EAP methods with peer. If the client NAKs all the EAP
methods proposed, the first RADIUS server forwards it to yet another
RADIUS server.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf
Of Jari Arkko
Sent: Wednesday, November 12, 2003 9:11 AM
To: Bernard Aboba
Cc: [email-masked]
Subject: Re: [eap] Issue 199: Full authenticator SM issue

Bernard Aboba wrote:
> Issue 199: Full authenticator SM issue
> Submitter name: Ashwin Palekar
> Submitter email address: [email-masked]
> Date first submitted: Nov 11, 2003
> Reference:
>
http://mail.frascone.com/pipermail/public/eap/2003-November/001832.html
> Document: SM-01
> Comment type: T
> Priority: S
> Section: 7
> Rationale/Explanation of issue:
> 
> Can the EAP server forward to other servers if it cannot negotiate
> authentication? The EAP full authenticator seems to allow Pass-through
in
> this case.

Do you mean the case where EAP is forwarded first to a RADIUS server,
and then that forwards it *again* to yet another RADIUS server?

I think this should be allowed.

--Jari

_______________________________________________
eap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/eap
_______________________________________________
eap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/eap

---

From: Jari Arkko <[email-masked]>
Date: Wed, 12 Nov 2003 21:18:36 +0200

> methods proposed, the first RADIUS server forwards it to yet another

Yes.

I have looked at the state machine again, and now I believe
it does not support this (and that is OK).

The way that I read the state machines is that the full
machine is for the NAS that either does the authentication
itself or forwards it to a RADIUS server. But the RADIUS
server side should follow only the backend machine. And
the backend machine does not have a transition to send
the authentication somewhere else. Pasi, John, & co --
is this your interpretation too?

--Jari

---

From: Yoshihiro Ohba <[email-masked]>
Date: Wed, 12 Nov 2003 11:53:12 -0800

In this case, the second RADIUS server will receive a Nak while it is 
in "PICK_UP_METHOD" state.  There are two issues:

- Does RFC3579 allow "pickup" operation when the initial EAP-Response
is a Nak?  I think the document is a bit vague on this (at least it
does not seem to prohibit the case).

- If the above question is yes, how does the backend authenticator
state machine work in this case?  I think there would need a state
transition from "PICK_UP_METHOD" to "NAK" state to explicitly support
the case.

Yoshihiro Ohba

---

From: Yoshihiro Ohba <[email-masked]>
Date: Wed, 12 Nov 2003 12:03:50 -0800

> is this your interpretation too?

I think that, if the first RADIUS server uses full authenticator state machine, 
with setting retransmission timer an infinite value (to prohibit timer-based 
retransmission), it is possible to support the scenario on the first RADIUS server.

Yoshihiro Ohba