Hello, it seems that FreeRADIUS is sending an EAP-Message fragment along with its Access-Accepts, as in: Packet-Type = Access-Accept Wed Sep 19 11:59:25 2007 MS-MPPE-Recv-Key = stuff MS-MPPE-Send-Key = morestuff EAP-Message = 0x03070004 Message-Authenticator = 0x593773a711f50bd8b4ce98434a7e1590 User-Name = "anonymous@restena.lu" Proxy-State = 0x323039 Whereas RFC 3579 , chapter 2.6.5 says: "An EAP-Message/EAP-Request/Notification SHOULD NOT be included within an Access-Accept or Access-Reject packet." This is now the second RADIUS implementation I see that behaves like that - is there a reason for the EAP-Message and something wrong with 3579, or is that SHOULD NOT just ignored by most? Greetings, Stefan Winter -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter@restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473
Stefan, the message included seems to me an EAP Success message (Code 0x03) and in no way an EAP Message/EAP Request/Notification (would be 0x01yyzzzz02). I do not see the problem at a first glance - am I mistaken? Artur On 19 Sep 2007, at 13:11, Stefan Winter wrote:
Hello,
it seems that FreeRADIUS is sending an EAP-Message fragment along with its Access-Accepts, as in:
Packet-Type = Access-Accept Wed Sep 19 11:59:25 2007 MS-MPPE-Recv-Key = stuff MS-MPPE-Send-Key = morestuff EAP-Message = 0x03070004 Message-Authenticator = 0x593773a711f50bd8b4ce98434a7e1590 User-Name = "anonymous@restena.lu" Proxy-State = 0x323039
Whereas RFC 3579 , chapter 2.6.5 says: "An EAP-Message/EAP-Request/Notification SHOULD NOT be included within an Access-Accept or Access-Reject packet."
This is now the second RADIUS implementation I see that behaves like that - is there a reason for the EAP-Message and something wrong with 3579, or is that SHOULD NOT just ignored by most?
Greetings,
Stefan Winter
-- Stefan WINTER
Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung
6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter@restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/ users.html
Stefan Winter wrote:
it seems that FreeRADIUS is sending an EAP-Message fragment along with its Access-Accepts, as in: ... Whereas RFC 3579 , chapter 2.6.5 says: "An EAP-Message/EAP-Request/Notification SHOULD NOT be included within an Access-Accept or Access-Reject packet."
See Appendix A. They clearly show EAP-Success in an Access-Accept. See also Section 2.6.3: Access-Accept packets SHOULD have only one EAP-Message attribute in them, containing EAP Success; similarly, Access-Reject packets SHOULD have only one EAP-Message attribute in them, containing EAP Failure.
This is now the second RADIUS implementation I see that behaves like that - is there a reason for the EAP-Message and something wrong with 3579, or is that SHOULD NOT just ignored by most?
I'm curious as to which implementations *don't* send EAP-Success in Access-Accept. If they don't do that, then what the heck is in the Access-Accept? Alan DeKok.
I'm curious as to which implementations *don't* send EAP-Success in Access-Accept. If they don't do that, then what the heck is in the Access-Accept?
Ah, never mind. This was just a mis-reading on my side then. Sorry for the noise. Stefan -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter@restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473
participants (3)
-
Alan DeKok -
Artur Hecker -
Stefan Winter