Subject: Re: [PANA] the case of mutiple authentications during a single PANA authentication phase

From: Alper Yegin <[email-masked]>
Date: Wed, 02 Apr 2003 12:31:14 -0800

How about this text:

"Some access networks might require or allow their clients to get
authenticated and authorized by the NAP and ISP before the
clients gain network access. PANA must be capable of enabling two
independent
authentication operations (i.e., execution of two separate EAP methods) for
the same client. Determining the authorization parameters as a result of two
separate authentications is an operational issue and therefore it is outside
the scope of PANA."

We still need the definitions of NAP and ISP...

alper

On 3/27/03 11:36 AM, "MORAND Lionel FTRD/DAC/ISS"
<[email-masked]> wrote:

> Hi Basavaraj,
>  
> Some weeks ago, we had a discussion on this subject. One of the scenarios
> requiring NAP-ISP authentications in the same PANA authentication session
> could be a NAP offering specific access configurations and local services to
> subscribed users accessing to value-added IP services provided by an ISP. In
> this case, the PAA may need to wait for the response of the ISP before
> determining the right handling of the access request (and the enforcement of
> the access control at the EP). For instance, a negative response from the ISP
> would limit the access network to a default access configuration and basic
> services. Distinct PAA sessions (one for NAP, another for ISP) would
> complicate the network policy (even if this point is outside the scope of
> PANA).
>  
> In the PS (section 2), the misunderstanding is maybe due to the fact that the
> end of the paragraph dealing with the NAP-ISP distinction only considers the
> case of link-layer authentication for the NAP (even if the "if" indicates that
> it is only one possibility).
> It is right that a link-layer authentication is often used for specific access
> configurations (e.g. in mobile networks). However, for scenarios in which a
> link-layer authentication mechanism is not available, the NAP could use PANA
> at the network-layer for the same purpose.
>  
> Considering the PANA proposal, it is stated that current solution supports
> multiple EAP authentications in the same PANA authentication phase. It is why
> I use the term MUST (maybe wrongly). I don't know how will be understood a
> SHOULD or a MAY in this case.
>  
> My strong feeling is that, if the NAP-ISP scenario is clearly identified and
> EAP makes it possible, the MUST in the requirement draft wouldn't be a real
> constraint.
> Saying that PANA must support it, even if it is an optional function of the
> PAA, seems to be coherent with both PS and solution drafts. But I'm open to
> another view.
>  
> Cheers,
>  
> Lionel
>  
>  
>> -----Message d'origine-----
>> De : [email-masked] [mailto:[email-masked]]
>> Envoyé : jeudi 27 mars 2003 18:24
>> À : MORAND Lionel FTRD/DAC/ISS; [email-masked];
>> [email-masked]; [email-masked]
>> Cc : [email-masked]
>> Objet : RE: [PANA] the case of mutiple authentications during a single PANA
>> authentication phase
>> 
>>  
>> Hi Lionel,
>>  
>> The PaC may be authenticated by the NAP  (via PAA) for network access at
>> which point in time the
>> PAA authorizes the EP to allow network access for the client.
>> Now why does the PAA have to wait for the ISP to authorize access as well. I
>> believe the two can
>> be distinct operations. What the usage scenarios I-D is saying I believe is
>> that with PANA you
>> could do multi-level authentications. But I do not believe it implies that
>> the PAA has to corelate
>> authorizations from different authorities (NAP, ISP) for enforcing access
>> control at the EP.
>>  
>> I do not believe that the requirement that you state below of "PANA MUST be
>> capable of supporting
>> multiple ....." needs to be a MUST. In fact I think MAY is better suited if
>> at all we need something
>> like it. For the scenario where multiple levels of authentication is
>> required, would it not suffice
>> to do these sequentially?
>>  
>> -Basavaraj
>>> -----Original Message-----
>>> From: ext MORAND Lionel FTRD/DAC/ISS
>>> [mailto:[email-masked]]
>>> Sent: 27 March, 2003 03:49 AM
>>> To: [email-masked]; [email-masked];
>>> [email-masked]
>>> Cc: [email-masked]
>>> Subject: [PANA] the case of mutiple authentications during a single PANA
>>> authentication phase
>>> 
>>> In the problem statement/usage scenarios draft as well as in the first PANA
>>> proposal, the case of multiple authentications during the same PANA session
>>> is clearly identified, mainly to allow separate authentications at the NAP
>>> and ISP levels. However, this is not taken into account in the current PANA
>>> requirements draft. In order to align the three documents, we should add the
>>> case of multiple authentications into the section 4.1.1 "Authentication of
>>> client" of the PANA requirements draft. A simple wording could be:
>>>  
>>> "PANA MUST be capable of supporting multiple independent client's
>>> authentications during a single PANA authentication phase."
>>>  
>>> I use the term "MUST" because this requirement is identified within the
>>> problem statement draft and already supported by the current PANA proposal
>>> (even if it is an optional functionality of the PAA).
>>>  
>>> As a consequence of the above requirement, a PAA may therefore need to wait
>>> for the results of two distinct client authentications before it can grant
>>> or deny access to network resources. This could be underlined in the first
>>> paragraph of the section 4.1.2 "Authorization, Accounting and Access
>>> Control". Here is a proposal:
>>>  
>>> "The binary authorization provided by PANA MAY be the result of multiple
>>> independent client's authentications. In this case, the policy used for
>>> determining the authorization result is outside the scope of PANA."
>>>  
>>> Does it sound acceptable?
>>>  
>>> BR,
>>>  
>>> Lionel.
>