Re: [Emu] EAP and authorization

[Stephen Hanna <shanna at juniper.net>]

Glen,

Thanks for clarifying your position. I believe that your argument is
that because EAP is an "authentication framework", it should not be
allowed to carry anything other than authentication protocols.
Is that correct? My apologies if this is not quite right. I am
having some difficulty finding a crisp summary of your position
in your emails. Please feel free to clarify your point of view.

I would argue that an "authentication framework" should not just be
concerned with verifying the EAP peer's identity. EAP should also
include other elements relevant to the authentication process and
the decision about whether to grant network access. For example,
password change requests should be allowed. Channel bindings are
another example. Having the peer send information about the NAS to
the EAP server allows the server to warn the peer about a lying NAS.
It also helps the server decide whether the peer is authorized to
obtain the requested network service. Performing a NEA assessment
helps the server decide whether the peer is secure enough to connect
to the network.

I suppose that my basic argument is a practical one. Password change,
channel bindings, and NEA assessments are useful things to do during
the EAP exchange. They are relevant to the authentication process and
the server's decision about whether to grant network access. There is
no harm in doing them as part of the EAP exchange. And there is no
better way to implement them. Would you like to argue with any of
these assertions?

Thanks,

Steve