Re: [Technical Errata Reported] RFC5176 (2012)

[Alan DeKok <aland@deployingradius.com>]

Avi Lior wrote:
> yes.  But the danger here is that the NAS may not understand the attributes that are offering the alternate (limiting) service and would interpret the response as a full access-accept.

  I agree.  Access-Accept means "let them on the network", and only
*partially* "give them limited services".  There are just too many
unknowns around NAS behavior to over-load Access-Accept.

> If the NAS did not indicate support for the new attributes that an Access-Reject may be the correct response.

  Many systems use Reply-Message as a feedback for failed
authentication.  e.g. "Password expired".

  I'm ambivalent about using Error-Cause.  I don't see many major
problem with it.  But it does extend the meaning of Access-Reject past
"go away, and I'm not telling you why".

  In this case, Error-Cause seems to be a substitute for an
administrator actually knowing the NAS capabilities, and configuring
them properly.  This would seem to be most useful for global proxy chains.

  Alan DeKok.

--
to unsubscribe send a message to radiusext-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://psg.com/lists/radiusext/>