RE: FW: [Pana] RADIUS Access-Reject and NAP/ISP authz

["Nelson, David" <dnelson@enterasys.com>]

> Well, a first step might be for the WG Chairs to express the
> historic semantics of the Access-Reject message and even, perhaps,
> the WG consensus regarding it (determining that as necessary).

Bernard may see this differently, but my own observation from the
discussion to date on the list is that the RADEXT WG does not have a
clear consensus on the semantics of the Access-Reject message and the
permissible attributes that may appear therein.

I think, historically speaking, that the RADIUS WG probably *did* have a
clear consensus on what they thought Access-Reject meant, but that was
then and this is now.  Access-Reject has classically meant "no service".
I think that some of the RFCs published between the closing of the
RADIUS WG and the chartering of the RADEXT WG may have blurred the
classical semantics of Access-Reject.  There is currently a debate over
what "service" means, although I hope that "no" still means "no".  :-)

It seems to me that the pertinent question is what the RADEXT WG thinks
is the correct semantics for Access-Reject for current and future RADIUS
work.


--
to unsubscribe send a message to radiusext-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://psg.com/lists/radiusext/>