Re: [Dime] FW: [Editorial Errata Reported] RFC4072 (2317)

[Souheil Ben Ayed <[e-mail]>]

Glen Zorn wrote:
>
> Souheil Ben Ayed [mailto:[e-mail]] writes:
>
>  
>
> Dear all,
>
> Please read the section " 2.7.  Accounting" of the RFC 4072.
>
> In this section, it is described that one or more
> Accounting-EAP-Auth-Method AVPs may be added in a Diameter-EAP-Answer 
> with a successful result code.
>
>  
>
> So what is correct ?
> - Allow adding one or more Accounting-EAP-Auth-Method AVPs?
> - or only one Accounting-EAP-Auth-Method AVP can be included in a 
> Diameter-EAP-Answer?
>
> The latter, I think.
>
>
When only one Accounting-EAP-Auth-Method AVP is included in a 
Diameter-EAP-Answer, which EAP method will be included in this AVP in 
the case of an authentication with EAP-TTLS/EAP-MD5, EAP-TTLS/EAP-TLS or 
any other EAP method that creates a tunnel then authenticates the user 
with a second EAP method? Should we include only the first used EAP 
method (in this case EAP-TTLS Type 21), or the second EAP method used 
for the authentication ?

Souheil
>
>
> Souheil
>
>
> Glen Zorn wrote:
>
> Dan Romascanu [mailto://[e-mail]] writes:
>  
>   
>
>     Dime WG,
>
>      
>
>     Please assess this errata report.
>
>      
>
>     If I understand well then Souheil's observation is that more
>
>     Accounting-EAP-Auth-Method AVPs can be included. This seems more like a
>
>     Technical errata, which if accepted can create interoperability problems
>
>     with existing deployment. Am I correct?
>
>         
>
>  
> I think that your understanding is correct, but the errata makes no sense to
> me: AFAIK, only one EAP method can be used in authenticating a user (EAP
> methods cannot be chained) & even if they could (as proposed for the new
> tunneled EAP method under development in EMU), the structure of the Diameter
> EAP app mirrors that of EAP (request/response).  Two EAP methods cannot be
> operational simultaneously, so why would two method identifiers need to be
> in the same Diameter message?
>  
>   
>
>     Thanks and Regards,
>
>      
>
>     Dan
>
>      
>
>     -----Original Message-----
>
>     From: RFC Errata System [mailto:[e-mail]]
>
>     Sent: Thursday, July 01, 2010 7:31 AM
>
>     To: [e-mail] <mailto:[e-mail]>; [e-mail] <mailto:[e-mail]>; [e-mail] <mailto:[e-mail]>;
>
>     Romascanu, Dan (Dan); [e-mail] <mailto:[e-mail]>; [e-mail] <mailto:[e-mail]>;
>
>     [e-mail] <mailto:[e-mail]>; [e-mail] <mailto:[e-mail]>
>
>     Cc: [e-mail] <mailto:[e-mail]>; [e-mail] <mailto:[e-mail]>
>
>     Subject: [Editorial Errata Reported] RFC4072 (2317)
>
>      
>
>      
>
>     The following errata report has been submitted for RFC4072, "Diameter
>
>     Extensible Authentication Protocol (EAP) Application".
>
>      
>
>     --------------------------------------
>
>     You may review the report below and at:
>
>     http://www.rfc-editor.org/errata_search.php?rfc=4072&eid=2317 <http://www.rfc-editor.org/errata_search.php?rfc=4072&eid=2317>
>
>      
>
>     --------------------------------------
>
>     Type: Editorial
>
>     Reported by: Souheil Ben Ayed <[e-mail]> <mailto:[e-mail]>
>
>      
>
>     Section: 3.2.
>
>      
>
>     Original Text
>
>     -------------
>
>           <Diameter-EAP-Answer> ::= < Diameter Header: 268, PXY >
>
>      
>
>                                     < Session-Id >
>
>      
>
>                                     { Auth-Application-Id }
>
>      
>
>                                     { Auth-Request-Type }
>
>      
>
>                                     { Result-Code }
>
>      
>
>                                     { Origin-Host }
>
>      
>
>                                     { Origin-Realm }
>
>      
>
>                                     [ User-Name ]
>
>      
>
>                                     [ EAP-Payload ]
>
>      
>
>                                     [ EAP-Reissued-Payload ]
>
>      
>
>                                     [ EAP-Master-Session-Key ]
>
>      
>
>                                     [ EAP-Key-Name ]
>
>      
>
>                                     [ Multi-Round-Time-Out ]
>
>      
>
>                                     [ Accounting-EAP-Auth-Method ]
>
>      
>
>                                     [ Service-Type ]
>
>      
>
>     Corrected Text
>
>     --------------
>
>           <Diameter-EAP-Answer> ::= < Diameter Header: 268, PXY >
>
>      
>
>                                     < Session-Id >
>
>      
>
>                                     { Auth-Application-Id }
>
>      
>
>                                     { Auth-Request-Type }
>
>      
>
>                                     { Result-Code }
>
>      
>
>                                     { Origin-Host }
>
>      
>
>                                     { Origin-Realm }
>
>      
>
>                                     [ User-Name ]
>
>      
>
>                                     [ EAP-Payload ]
>
>      
>
>                                     [ EAP-Reissued-Payload ]
>
>      
>
>                                     [ EAP-Master-Session-Key ]
>
>      
>
>                                     [ EAP-Key-Name ]
>
>      
>
>                                     [ Multi-Round-Time-Out ]
>
>      
>
>                                   * [ Accounting-EAP-Auth-Method ]
>
>      
>
>                                     [ Service-Type ]
>
>      
>
>     Notes
>
>     -----
>
>     When one or more EAP methods used for authenticating the user, for each
>
>     used EAP method an Accounting-EAP-Auth-Method AVP is added in the
>
>     Diameter-EAP-Answer with a successful result code. In the message format
>
>     of Diameter-EAP-Answer, one or more Accounting-EAP-Auth-Method AVPs can
>
>     be included.
>
>      
>
>     Instructions:
>
>     -------------
>
>     This errata is currently posted as "Reported". If necessary, please use
>
>     "Reply All" to discuss whether it should be verified or rejected. When a
>
>     decision is reached, the verifying party (IESG) can log in to change the
>
>     status and edit the report, if necessary.
>
>      
>
>     --------------------------------------
>
>     RFC4072 (draft-ietf-aaa-eap-10)
>
>     --------------------------------------
>
>     Title               : Diameter Extensible Authentication Protocol (EAP)
>
>     Application
>
>     Publication Date    : August 2005
>
>     Author(s)           : P. Eronen, Ed., T. Hiller, G. Zorn
>
>     Category            : PROPOSED STANDARD
>
>     Source              : Authentication, Authorization and Accounting
>
>     Area                : Operations and Management
>
>     Stream              : IETF
>
>     Verifying Party     : IESG
>
>     _______________________________________________
>
>     DiME mailing list
>
>     [e-mail] <mailto:[e-mail]>
>
>     https://www.ietf.org/mailman/listinfo/dime
>
>         
>
>  
>  
> _______________________________________________
> DiME mailing list
> [e-mail] <mailto:[e-mail]>
> https://www.ietf.org/mailman/listinfo/dime
>  
>   
>
>  
>