Subject: [PANA] the case of mutiple authentications during a single PANA authentication phase

From: "MORAND Lionel FTRD/DAC/ISS" <[email-masked]>
Date: Thu, 27 Mar 2003 10:48:50 +0100

In the problem statement/usage scenarios draft as well as in the first PANA proposal, the case of multiple authentications during the same PANA session is clearly identified, mainly to allow separate authentications at the NAP and ISP levels. However, this is not taken into account in the current PANA requirements draft. In order to align the three documents, we should add the case of multiple authentications into the section 4.1.1 "Authentication of client" of the PANA requirements draft. A simple wording could be:
 
"PANA MUST be capable of supporting multiple independent client's authentications during a single PANA authentication phase."
 
I use the term "MUST" because this requirement is identified within the problem statement draft and already supported by the current PANA proposal (even if it is an optional functionality of the PAA).
 
As a consequence of the above requirement, a PAA may therefore need to wait for the results of two distinct client authentications before it can grant or deny access to network resources. This could be underlined in the first paragraph of the section 4.1.2 "Authorization, Accounting and Access Control". Here is a proposal:
 
"The binary authorization provided by PANA MAY be the result of multiple independent client's authentications. In this case, the policy used for determining the authorization result is outside the scope of PANA."
 
Does it sound acceptable?
 
BR,
 
Lionel.

---

From: <[email-masked]>
Date: Thu, 27 Mar 2003 11:24:28 -0600

Hi Lionel,
 
The PaC may be authenticated by the NAP  (via PAA) for network access at which point in time the
PAA authorizes the EP to allow network access for the client. 
Now why does the PAA have to wait for the ISP to authorize access as well. I believe the two can
be distinct operations. What the usage scenarios I-D is saying I believe is that with PANA you 
could do multi-level authentications. But I do not believe it implies that the PAA has to corelate
authorizations from different authorities (NAP, ISP) for enforcing access control at the EP.
 
I do not believe that the requirement that you state below of "PANA MUST be capable of supporting
multiple ....." needs to be a MUST. In fact I think MAY is better suited if at all we need something 
like it. For the scenario where multiple levels of authentication is required, would it not suffice
to do these sequentially?
 
-Basavaraj

-----Original Message-----
From: ext MORAND Lionel FTRD/DAC/ISS [mailto:[email-masked]]
Sent: 27 March, 2003 03:49 AM
To: [email-masked]; [email-masked]; [email-masked]
Cc: [email-masked]
Subject: [PANA] the case of mutiple authentications during a single PANA authentication phase

 

 
 
BR,
 
Lionel.

---

From: "MORAND Lionel FTRD/DAC/ISS" <[email-masked]>
Date: Thu, 27 Mar 2003 20:36:10 +0100

Hi Basavaraj,
 
Some weeks ago, we had a discussion on this subject. One of the scenarios requiring NAP-ISP authentications in the same PANA authentication session could be a NAP offering specific access configurations and local services to subscribed users accessing to value-added IP services provided by an ISP. In this case, the PAA may need to wait for the response of the ISP before determining the right handling of the access request (and the enforcement of the access control at the EP). For instance, a negative response from the ISP would limit the access network to a default access configuration and basic services. Distinct PAA sessions (one for NAP, another for ISP) would complicate the network policy (even if this point is outside the scope of PANA).
 
In the PS (section 2), the misunderstanding is maybe due to the fact that the end of the paragraph dealing with the NAP-ISP distinction only considers the case of link-layer authentication for the NAP (even if the "if" indicates that it is only one possibility).
It is right that a link-layer authentication is often used for specific access configurations (e.g. in mobile networks). However, for scenarios in which a link-layer authentication mechanism is not available, the NAP could use PANA at the network-layer for the same purpose.
 
Considering the PANA proposal, it is stated that current solution supports multiple EAP authentications in the same PANA authentication phase. It is why I use the term MUST (maybe wrongly). I don't know how will be understood a SHOULD or a MAY in this case.
 
My strong feeling is that, if the NAP-ISP scenario is clearly identified and EAP makes it possible, the MUST in the requirement draft wouldn't be a real constraint.
Saying that PANA must support it, even if it is an optional function of the PAA, seems to be coherent with both PS and solution drafts. But I'm open to another view.
 
Cheers,
 
Lionel

-----Message d'origine-----
De : [email-masked] [mailto:[email-masked]]
Envoyé : jeudi 27 mars 2003 18:24
À : MORAND Lionel FTRD/DAC/ISS; [email-masked]; [email-masked]; [email-masked]
Cc : [email-masked]
Objet : RE: [PANA] the case of mutiple authentications during a single PANA authentication phase

Hi Lionel,

 
-Basavaraj

-----Original Message-----
From: ext MORAND Lionel FTRD/DAC/ISS [mailto:[email-masked]]
Sent: 27 March, 2003 03:49 AM
To: [email-masked]; [email-masked]; [email-masked]
Cc: [email-masked]
Subject: [PANA] the case of mutiple authentications during a single PANA authentication phase

 

 
 
BR,
 
Lionel.