Re: [pcp] EAP retransmits and re-authentication

[Margaret Wasserman <[e-mail]>]

On Sep 20, 2012, at 12:12 PM, Yoshihiro Ohba wrote:
>> Actually, I didn't propose a change; I simply pointed out that you can
>> do it either way depending on what is easiest for PCP implementations;
>> we should pick, but what we pick should be based on the needs of the PCP
>> community.
> 
> I would rather consider this as the major disadvantage of tight
> coupling EAP and PCP.  It is much easier to run PANA and PCP
> side-by-side which achieves loose coupling of EAP and PCP.=

The problem is that running PCP and PANA side-by-side doesn't really change anything...

Either we change PCP to have a notion of a "session" that is associated with every mapping, and to understand to understand that external events can cause an asynchronous event of some sort that invalidates all of those mappings, or we don't...

I greatly prefer a model where the a client is authenticated and authorized to create a mapping, at the time that the mapping is created, and there is no presumption that the mapping is tied to any sort of ongoing client authentication/authorization.

Otherwise, I suppose we could _claim_ to support re-authentication, but what does it mean if PANA performs re-authentication and there is no meaningful way to communicate a re-authentication success, or more importantly perhaps, a re-authentication failure to PCP.

How are you imagining this would work in the side-by-side case -- re-authentication occurs, and then what?

Margaret