Re: [core] concerns re draft-oflynn-core-bootstrapping-02

OK, then let me use the term "RADIUS server" to explain.

Any EAP transport protocol such as IEEE 802.1X and PANA works with
multiple AAA domains in which a single access network may interface to
multiple RADIUS servers where each RADIUS server serves for a distinct
AAA domain.  With EAP, RADIUS routing is based on the EAP peer
identity such as "foo@domainA.com" and "bar@domainB.com" in a way that
authentication messages for EAP peer "foo@domainA.com"are routed to
"domainA.com" RADIUS server and authentication messages for EAP peer
"bar@domainB.com" are routed to "domainB.com" RADIUS server.  The EAP
peer identity is extracted from the initial EAP exchange by an EAP
pass-through authenticator that is co-located with a RADIUS client at
the border of the access network.  In a large scale RADIUS deployment,
there may be RADIUS proxies between a RADIUS client and a RADIUS
server to simplify the AAA routing task for RADIUS clients.  In PANA,
PAA (PANA Authentication Agent) is the EAP pass-through authenticator,
and PaC (PANA Client) is the EAP peer.

Hope this helps,
Yoshihiro Ohba

(2010/10/29 6:21), Carsten Bormann wrote:
> On Oct 28, 2010, at 22:48, Alper Yegin wrote:
> 
>> mothership
> 
> I think other terms are "mother-may-I", "trust center", "RADIUS server", or "Policy Decision Point".  Just guessing, though.
> I think the use case of interest here is a single constrained network that simultaneously serves multiple trust domains, so being authorized by any one of them should give you access.
> 
> With that potential explanation, can you elucidate whether (and maybe how) PANA would work in this scenario?
> 
> Gruesse, Carsten
> 
> _______________________________________________
> core mailing list
> core@ietf.org
> https://www.ietf.org/mailman/listinfo/core
> 