Subject: (radius) EAP-Start

From: Carl Rigney <[email-masked]>
Date: Fri, 30 Apr 1999 02:15:44 -0700 (PDT)

draft-ietf-radius-ext-03.txt currently says:
> EAP-Start is indicated by sending an EAP-Message attribute
> with a length of 2 (no data).

Attributes with zero-length data are not allowed, so this needs to be
reconciled.  I'm not very familiar with EAP, is there an actual
EAP-Start packet that could be included in the EAP-Message?  That would
solve this problem handily.  Or lacking that, is there some kind of
EAP-NOP?

The Extensions draft is otherwise ready for Working Group Last Call,
but I wanted to see if there's some easy fix for this that I can apply
before sending it out.

Also, the current text in ext-03 says User-Name can be returned in an
Access-Accept or Access-Challenge.  I think Challenge should be deleted
since currently User-Name is not permitted in Challenge (and doesn't
seem necessary, since it can now be sent in the Access-Accept).

Mail directly to me, or to the list if you wish.  Saying that 0-length
attributes should be allowed is a dead subject, I'm looking for something
else here.

--
Carl Rigney
RADIUS WG Editor
[email-masked]
-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.

---

From: "Bernard Aboba" <[email-masked]>
Date: Fri, 30 Apr 1999 11:04:20 -0700

EAP-Start is not part of EAP, since an EAP-Start message
will never be sent by an EAP peer or authenticator. 
It is merely a signal from RADIUS client to the RADIUS 
server. 

As such, signalling of EAP-Start needs to be handled within
RADIUS. An alternative (albeit ugly) way to handle this 
would be to add another attribute, EAP-Start. 

I would also mention that there are limited applications for
EAP-Start. Most implementations that I am familiar with begin
the EAP conversation by sending an 
EAP-Message/EAP-Response/Identity packet to the RADIUS server. 

As a result, they never send an EAP-Start. The primary application
for EAP-Start is in DNIS identification, in which the
EAP-Message/EAP-Request/Identity is typically not sent. For example, this 
would allow for Internet access based on telephone number and
possession of a token card. 

In such a case, the Access-Request would contain an EAP-Start 
as well as Calling-Station-Id and/or Called-Station-ID attributes. 
The function of the EAP-Start is to allow the RADIUS client to signal
the RADIUS server that it is EAP-capable. This allows the RADIUS
server to avoid sending an EAP-Message attribute to a NAS that
does not support it. 

Removing User-Name from the Access-Challenge is not a good idea
since this will prevent RADIUS proxies from forwarding the
messages based on the realm within the NAI. This would be needed
for example, if someone wanted to implement roaming support for
EAP.  

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]]On Behalf Of Carl Rigney
Sent: Friday, April 30, 1999 2:16 AM
To: [email-masked]
Subject: (radius) EAP-Start

-