: Re: Change to "Reply-Message AVP" usage in Diameter EAP

We would like AAA WG input by Friday August 12, 2005.  Please send your
opinions to the mailing list, stating clearly whether you are "For" or
"Against" this change.

On Tue, 9 Aug 2005, Bernard Aboba wrote:

> Tom Hiller and Glen Zorn have found an issue in Diameter EAP that they
> would like to fix in AUTH48.
>
> The issue relates to an inconsistency between RADIUS/EAP as specified
> in RFC 3579, and Diameter with respect to the Reply-Message AVP.
>
> We now have:
>
> 2.8.3.  Displayable Messages
>
>     The Reply-Message AVP [NASREQ] contains text which may be displayed
>     to the user.  Note that the NAS does not necessarily have any
>     facility for actually sending these messages to the user.  In any
>     case, the NAS MUST NOT manufacture any EAP packets (such as
>     EAP-Request/Notification) from Reply-Message AVPs.
>
> Tom has suggested:
>
> 2.8.3.  Displayable Messages
>
> The Reply-Message AVP [NASREQ] MUST NOT be included in any Diameter
> message containing an EAP-Payload AVP.
>
> Here is the text in RFC 3579, Section 2.6.5:
>
> 2.6.5.  Displayable Messages
>
>    The Reply-Message attribute, defined in [RFC2865], Section 5.18,
>    indicates text which may be displayed to the peer.  This is similar
>    in concept to EAP Notification, defined in [RFC2284].  When sending a
>    displayable message to a NAS during an EAP conversation, the RADIUS
>    server MUST encapsulate displayable messages within
>    EAP-Message/EAP-Request/Notification attribute(s).  Reply-Message
>    attribute(s) MUST NOT be included in any RADIUS message containing an
>    EAP-Message attribute.  An EAP-Message/EAP-Request/Notification
>    SHOULD NOT be included within an Access-Accept or Access-Reject
>    packet.
>
>    . . .
>
>    To avoid these problems, a NAS receiving a Reply-Message attribute
>    from the RADIUS server SHOULD silently discard the attribute, rather
>    than attempting to translate it to an EAP Notification Request.
>