Re: [pcp] gss-eap & client-side rexmit only

Margaret,

(2012/10/18 20:46), Margaret Wasserman wrote:
> Hi Alper,
>
> On Oct 18, 2012, at 2:04 AM, Alper Yegin wrote:
>>> Yep, there's no re-auth. It's absence is confirmed! :-)
> Does this mean that you think it is okay not to allow server-side reauthentication?  You wrote this before the call, but seemed to say otherwise on the call.
>
>>> - What happens if server-side needs to re-key, extend lifetime, change authorization, re-challenge the client?
>>> Say, the acceptor receives a RADIUS CoA with EAP-Request, what's going to do with it?
> If the PCP Server determines (for any reason) that the authentication information is invalid, it will invalidate it.  There is no reason to inform the client (or an enforcement point, or anyone else) that the information has been invalidated at that time, because _unlike the PANA case_ there is no need to block any ongoing session and/or any ongoing traffic from the PCP client to other nodes.

This is not true for tightly-coupled authentication/authorization 
model.  Tightly-coupled
authentication/authorization model (which is typical in AAA architecture)
needs to be supported, and in tightly-coupled 
authentication/authorization model,
support for server-initiated re-authentication makes a lot of sense.  
This does not
mean clients cannot sleep.  Clients can sleep but they may just miss to 
receive
server-initiated re-authentication requests, and if that happens they 
will need to start
full authentication, which is fine.   I don't disagree with additional 
support of loosely coupled model,
but I disagree if you say tightly-coupled authentication/authorization 
model is not needed.

Yoshihiro Ohba

> The client can find out that the authentication information has been invalidated when/if it sends a PCP request using the now-invalid authentication information.  This will cause the PCP Server to return an authentication error, and the client will attempt to re-authenticate.
>
>>> Sorry folks, gss-eap as an EAP lower layer spec is incomplete. Whether you recognize and accept this today, or later when you start building complete architectures/systems with it. No worries, you can always add it.
> This is an issue you should raise with the abfab WG, i guess.  I don't think they will agree with you.
>
> Margaret
>
>
> _______________________________________________
> pcp mailing list
> pcp@ietf.org
> https://www.ietf.org/mailman/listinfo/pcp
>