RE: : Change to "Reply-Message AVP" usage in Diameter EAP

Back when RFC 3579 was written, sending Reply-Message was a bad idea
because the only things the NAS could do with it was discard it (so
sending it wasn't necessary) or convert it to an EAP Notification
packet (a really bad idea for several reasons).

Since then, things have changed. For instance, PANA has the ability 
to send a displayable message to the client, and Reply-Message would 
be the most logical attribute for this (and is used for this purpose
in draft-ieft-pana-aaa-interworking-00). So if we prohibit using
Reply-Message, we may at some point need to define an identical
attribute with a different name/number to get around this "MUST NOT".

While IMHO this is the wrong choice from technical point of view 
(and it is RFC 3579 that needs updating rather than Diameter EAP), 
my impression from other AAA WG documents suggests that arguing 
about this issue will have no other effect than stretching the
Author's 48 Weeks period even longer. I really would like to get 
this document out some time this year, so if making this change
gets it published sooner, let it be so...

Best regards,
Pasi

> -----Original Message-----
> From: Bernard Aboba
> Sent: Tuesday, August 09, 2005 7:04 PM
> To: [email protected]
> Subject: [AAA-WG]: Change to "Reply-Message AVP" usage in Diameter EAP
> 
> 
> Tom Hiller and Glen Zorn have found an issue in Diameter EAP that
> they would like to fix in AUTH48.
> 
> The issue relates to an inconsistency between RADIUS/EAP as
> specified in RFC 3579, and Diameter with respect to the
> Reply-Message AVP.

> 
> We now have:
> 
> 2.8.3.  Displayable Messages
> 
>     The Reply-Message AVP [NASREQ] contains text which may be
>     displayed to the user.  Note that the NAS does not necessarily
>     have any facility for actually sending these messages to the
>     user.  In any case, the NAS MUST NOT manufacture any EAP packets
>     (such as EAP-Request/Notification) from Reply-Message AVPs.

> 
> Tom has suggested:
> 
> 2.8.3.  Displayable Messages
> 
> The Reply-Message AVP [NASREQ] MUST NOT be included in any Diameter
> message containing an EAP-Payload AVP.
> 
> Here is the text in RFC 3579, Section 2.6.5:
> 
> 2.6.5.  Displayable Messages
> 
>    The Reply-Message attribute, defined in [RFC2865], Section 5.18,
>    indicates text which may be displayed to the peer.  This is
>    similar in concept to EAP Notification, defined in [RFC2284].
>    When sending a displayable message to a NAS during an EAP
>    conversation, the RADIUS server MUST encapsulate displayable
>    messages within EAP-Message/EAP-Request/Notification
>    attribute(s).  Reply-Message attribute(s) MUST NOT be included in
>    any RADIUS message containing an EAP-Message attribute.  An
>    EAP-Message/EAP-Request/Notification SHOULD NOT be included
>    within an Access-Accept or Access-Reject packet.
> 
>    . . .
> 
>    To avoid these problems, a NAS receiving a Reply-Message
>    attribute from the RADIUS server SHOULD silently discard the
>    attribute, rather than attempting to translate it to an EAP
>    Notification Request.
>