vsa and authenticate-only service-type
Hi The pam_radius module currently uses the service-type authenticate-only when sending an access-request. The rfc says this about "authenticate only": Only Authentication is requested, and no authorization information needs to be returned in the Access-Accept Does this mean that if I want the server to send some VSA in the reply-message i should not use this? Is it OK to not send any service-type? thanks Ganesh Connect with friends all over the world. Get Yahoo! India Messenger at http://in.messenger.yahoo.com/?wm=n/
The pam_radius module currently uses the service-type authenticate-only when sending an access-request.
The rfc says this about "authenticate only": Only Authentication is requested, and no authorization information needs to be returned in the Access-Accept
Does this mean that if I want the server to send some VSA in the reply-message i should not use this?
No. "no authorization information *needs* to be returned" - not required but you *can* do it if you want.
Is it OK to not send any service-type?
Yes, that or any other attribute in the reply. For services that *really* don't require any authorization attributes. Ivan Kalik Kalik Informatika ISP
ganesh subramonian wrote:
Hi
The pam_radius module currently uses the service-type authenticate-only when sending an access-request.
The rfc says this about "authenticate only": Only Authentication is requested, and no authorization information needs to be returned in the Access-Accept
Does this mean that if I want the server to send some VSA in the reply-message i should not use this? Is it OK to not send any service-type?
It means that the PAM client won't look for *any* response attributes in an Access-Accept. Nothing in the documentation says that sending Service-Type or a VSA will do anything. So... they won't do anything. Alan DeKok.
participants (3)
-
Alan DeKok -
ganesh subramonian -
tnt＠kalik.net