Subject: [Pana] [issue113] Proposed text, solicitataion for comments.

From: [email-masked]
Date: Mon, 29 Nov 2004 15:03:58 +0200

Solicitation for comments, if any.
- Dan

http://danforsberg.info:8080/pana-issues/issue113
Dan:

Change from:

   "o  Authorization phase: Following a successful PANA authentication
       phase, the PaC gains access to the network and can send and
       receive IP data traffic through EP. "

To:

   "o  Authorization phase: Authorization takes place after a
       successful EAP authentication.  If authorization is succesful
       PaC and PAA establish a PANA session and PaC gains access to
       the network through EP(s). "

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Avi Lior <[email-masked]>
Date: Mon, 29 Nov 2004 09:54:50 -0500

"If Authorization is successful..."

How do we do authorization in PANA?
Is it really the PaC that gains access to the network through the EP(s) or
the device where the Pac resides?

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] 
> Sent: November 29, 2004 8:04 AM
> To: [email-masked]
> Subject: [Pana] [issue113] Proposed text, solicitataion for comments.
> 
>

---

From: [email-masked]
Date: Tue, 30 Nov 2004 09:41:03 +0200

I think the authorization happens at the same time as the
authentication, because PANA itself doesn't do any policy control
etc. for authorization. 

In case of AAA backend in use, the Result-Code AVP tells the result of
the authorization as well.

Implicitly there is authorization, or should we say that the PANA
"rule" is authorize authenticated PaCs.

Any proposal for improvement?

- Dan

> From: ext Avi Lior [mailto:[email-masked]]
> Sent: 29 November, 2004 16:55
> To: Forsberg Dan (Nokia-NRC/Helsinki); [email-masked]
> Subject: RE: [Pana] [issue113] Proposed text, solicitataion for
> comments.
> 
>

---

From: Avi Lior <[email-masked]>
Date: Tue, 30 Nov 2004 11:56:16 -0500

I have no problem with that authorization happens at the same time as
authentication.  

There is no authorization phase. There is an authentication phase which
includes authorization.  So lets say that.

Currently the proposed change is wrong:

> > >        the network through EP(s). "

Original text:

 o  Authentication phase: Immediately following the handshake phase is
      the EAP execution between the PAA and PaC.  The EAP payloads
      (which carry an EAP method inside) is what is used for
      authentication.  Authentication phase may involve execution of two
      EAP sessions back-to-back, one for the NAP and one for the ISP.

   o  Authorization phase: Following a successful PANA authentication
      phase, the PaC gains access to the network and can send and
      receive IP data traffic through EP.  During this phase, the PaC
      and PAA may optionally ping each other to test liveness of the
      PANA session on each end.
 
Change to:

o     Authentication phase: Immediately following the handshake phase is
      the EAP execution between the PAA and PaC.  The EAP payloads
      (which carry an EAP method inside) is what is used for
      authentication.  Authentication phase may involve execution of two
      EAP sessions back-to-back, one for the NAP and one for the ISP. At the
end of a successful Authentication phase the host will be authorized to
access the network and the Access Phase commences. 

Access Phase: After a successful authentication the host gains access to the
network and can send and receive IP data traffic through the EP.  At any
time during this phase, the PaC and PAA may optionally ping each other to
test liveness of the PANA session on each end.

> Sent: Tuesday, November 30, 2004 2:41 AM
> To: [email-masked]; [email-masked]
> Subject: RE: [Pana] [issue113] Proposed text, solicitataion 
> for comments.
> 
> 
> authentication, because PANA itself doesn't do any policy 
> control etc. for authorization. 
> 
> In case of AAA backend in use, the Result-Code AVP tells the 
> result of the authorization as well.
> 
> Implicitly there is authorization, or should we say that the 
> PANA "rule" is authorize authenticated PaCs.
>