Subject: [AAA-WG]: Question about NAI Realm based routing of RADIUS

From: "Dhaval Shah" <[email-masked]>
Date: Wed, 14 Jun 2006 12:29:13 -0700

Hi
     I have a question about NAI
Realm based routing of AAA RADIUS
messages from say a 802.1x
authenticator to the Home AAA
server.
 
Consider the following example: (I
am using the notations from RFC
4282 (Network Access Identifier),
section 2.7)
 
Lets say autheticator received user
identity in EAP-Response packet as
NAI formed like
 
other2.example.net!home.example.net
[email-masked]
 
This NAI will be converted by the
RADIUS client of the 802.1x
authenticator as
 
[email-masked]
e.net
 
and forwarded to the IP address of
other2.example.net as a RADIUS
Access-Request.
 
My question is, RADIUS client
usually needs to share a "secret"
with AAA server, in the above
case where the client needs to send
the message through multiple
routing realms as coded
in the NAI, is it required that the
client MUST have a shared "secret"
with the first hop AAA
server/proxy towards the Home AAA
server? In the above case, does
802.1x authenticator
of other1.example.net needs to
share a "secret" with AAA server of
other2.example.net and
it MUST use that to prepare the
Message Authenticator? And
similarly, AAA server of
other2.example.net MUST share a
"secret" with home.example.net's
AAA server?
 
Also, what (if any) extensions must
be added to the RADIUS message
originating at the authenticator
to allow such realm based
forwarding of the packet to the
Home AAA server?
 
thanks
Dhaval