Re: [pcp] EAP retransmits and re-authentication

[Alper Yegin <[e-mail]>]

Sam,

This whole trying to decouple authentication from authorization couldn't more more wrong.

Non-PCP-specific background:
Authentication is done for the sake of authorization. The server (whether it's the PCP server, or Foo server) does not really care if you are really "Bob". They care what you are authorized to access. It's the backend policy server (e.g., RADIUS server) that knows Bob --> authorization parameters mapping. 

So, when PCP Client is authenticated as "Bob's PC", PCP server also learns the authorization parameters "allow him to use X ports for Y minutes". In AAA systems, authorization always has finite lifetime (for better resource management). Bob needs to "re-authenticate" before Y minutes passes, otherwise his authorization is yanked. Ports are closed. Whatever state PCP server has created/allocated for "Bob's PC" are freed. That's it.

As soon as authorized lifetime expires, PCP server stops serving the client. That's the meaning of "lifetime" in AAA systems.

You have to re-authenticate before that happens.

This is how it's for any EAP-based system, this is how it's for any AAA (RADIUS/Diameter)-based system. 


How can you think PCP does not need re-authentication? 


Alper















On Sep 20, 2012, at 9:18 PM, Yoshihiro Ohba wrote:

> Sam,
> 
> Since PCP authentication is not part of base specification,
> authentication is already optional, which is fine.  But when
> authentication is used it needs to be tied with authorization.
> 
> Yoshihiro Ohba
> 
> 
> (2012/09/21 2:33), Sam Hartman wrote:
>> One thing to consider is that in many cases, PCP users will not be using
>> authentication; they will be using unauthenticated PCP.  So, especially
>> for PCP, it seems undesirable to tie authorization to authentication.
>> 
>> If an authorization revocation event happens--that is, a service
>> provider wants to stop providing service to a customer--they will
>> typically want to drop both unauthenticated and authenticated mappings.
>> The sort of things that might trigger this are  administrative action
>> (customer account suspended for immediate cause), address renumbering,
>> or lease expire.
>> 
>> For PCP it seems much more likely that these events will be tied to a
>> provisioning/authorization system than any event in an authentication
>> system.
>> 
>> Tieing this to authentication seems like it will miss important PCP use
>> cases.
>> Duplicating the same logic both for authentication and authorization
>> seems to introduce complexity that PCP does not need.
>> 
>> --Sam
>> 
> 
> _______________________________________________
> pcp mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/pcp