Re: [pcp] EAP retransmits and re-authentication

[Yoshihiro Ohba <[e-mail]>]

Sam,

Since PCP authentication is not part of base specification,
authentication is already optional, which is fine.  But when
authentication is used it needs to be tied with authorization.

Yoshihiro Ohba


(2012/09/21 2:33), Sam Hartman wrote:
> One thing to consider is that in many cases, PCP users will not be using
> authentication; they will be using unauthenticated PCP.  So, especially
> for PCP, it seems undesirable to tie authorization to authentication.
> 
> If an authorization revocation event happens--that is, a service
> provider wants to stop providing service to a customer--they will
> typically want to drop both unauthenticated and authenticated mappings.
> The sort of things that might trigger this are  administrative action
> (customer account suspended for immediate cause), address renumbering,
> or lease expire.
> 
> For PCP it seems much more likely that these events will be tied to a
> provisioning/authorization system than any event in an authentication
> system.
> 
> Tieing this to authentication seems like it will miss important PCP use
> cases.
> Duplicating the same logic both for authentication and authorization
> seems to introduce complexity that PCP does not need.
> 
> --Sam
>