vsa and authenticate-only service-type

[Alan DeKok]

ganesh subramonian wrote:
> Hi
> 
> The pam_radius module currently uses the service-type authenticate-only when sending an access-request.
> 
> The rfc says this about "authenticate only":
> Only Authentication is requested, and no authorization information needs to be returned in the Access-Accept
> 
> Does this mean that if I want the server to send some VSA in the reply-message i should not use this?
> Is it OK to not send any service-type?

  It means that the PAM client won't look for *any* response attributes
in an Access-Accept.

  Nothing in the documentation says that sending Service-Type or a VSA
will do anything.  So... they won't do anything.

  Alan DeKok.