Re: [pcp] gss-eap & client-side rexmit only

[Margaret Wasserman <[e-mail]>]

Hi Alper,

On Oct 18, 2012, at 2:04 AM, Alper Yegin wrote:
>> Yep, there's no re-auth. It's absence is confirmed! :-)

Does this mean that you think it is okay not to allow server-side reauthentication?  You wrote this before the call, but seemed to say otherwise on the call.

>> - What happens if server-side needs to re-key, extend lifetime, change authorization, re-challenge the client? 
>> Say, the acceptor receives a RADIUS CoA with EAP-Request, what's going to do with it?

If the PCP Server determines (for any reason) that the authentication information is invalid, it will invalidate it.  There is no reason to inform the client (or an enforcement point, or anyone else) that the information has been invalidated at that time, because _unlike the PANA case_ there is no need to block any ongoing session and/or any ongoing traffic from the PCP client to other nodes.  The client can find out that the authentication information has been invalidated when/if it sends a PCP request using the now-invalid authentication information.  This will cause the PCP Server to return an authentication error, and the client will attempt to re-authenticate.

>> Sorry folks, gss-eap as an EAP lower layer spec is incomplete. Whether you recognize and accept this today, or later when you start building complete architectures/systems with it. No worries, you can always add it.

This is an issue you should raise with the abfab WG, i guess.  I don't think they will agree with you.

Margaret