Re: [pcp] issue#61: Unsolicited reauthentication

[Alper Yegin <[e-mail]>]

> 
> Would it be desirable to support unsolicited re-authentication?
> 
> – May depend on answer to issue #60 – is there a need to renew authentication information when no requests are being issued?
> 
> Alper> As we discovered over the mailing list, there are cases where the PCP server sends unsolicited messages to the PCP client (e.g., when the mapping lifetime is updated). Such messages too need to be secured. So, tossing the PCP SA as soon as the first PCP request/response is completed after the EAP authentication does not work. PCP SA is needed later too. 
> 
> Alper> Besides, I don't understand why you'd want to toss the PCP SA away. Keep it around because you are likely to need it even at least for the subsequent requests from the PCP client. 
> 
> Alper> And, finally, RADIUS and Diameter support EAP re-authentication initiated by the AAA server. Unless we explicitly forbid that, they are there to be supported by any EAP lower-layer. 
> 
> 

Sam/Alan Dekok had pointed that EAP message carried in CoA can only be an EAP Notification. 
Correct, I missed that.

Nevertheless, "RADIUS and Diameter support EAP re-authentication initiated by the AAA server." still holds true. See below:

Diameter (RFC 4072):

"A home Diameter server MAY request EAP re-authentication by issuing
the Re-Auth-Request [BASE] message to the Diameter client."


For RADIUS, Termination-Action=RADIUS-Request is used for getting the NAS to initiation re-authentication.