RE: Follow up on Authorize Only issue (was RE: [Isms] ISMS session

["Glen Zorn \(gwz\)" <gwz@cisco.com>]

Avi Lior <mailto:avi@bridgewatersystems.com> supposedly scribbled:

> Hi,
> 
> If I was specifying how this is done:
> 
> It would be nice if the AAA client could return some sort of token to
> the AAA server to assert that the user has been authenticated by an
> entity that it trusts. The token can be generated by the
> Authentication Server.   
> 
> We need this assertion to make sure we deliver the correct profile.

I disagree: the fact that the message is being sent by an authenticated client at all says that the user has been authenticated elsewhere.  Note that safety requires the inclusion of a MAC (either the Message-Authenticator or preferably the Message-Authentication-Code Attribute) in the Access-Request.  

Hope this helps,

~gwz

Why is it that most of the world's problems can't be solved by simply
  listening to John Coltrane? -- Henry Gabriel

--
to unsubscribe send a message to radiusext-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://psg.com/lists/radiusext/>