HP-UX AAA Server A.08.01 administrator's guide (T1428-90072, May 2010)

Realm-Based EAP-AKA Configuration Information in EAP.authfile
The EAP.authfile entry for a realm that supports EAP-AKA can contain an optional
{} configuration block following the EAP-Type AKA specification. This block contains
realm-specific EAP-AKA configuration information, such as the algorithm to use for
the realm users, Fast-Reauth and Psueodnym parameters discussed later in the
chapter. For more information on Fast-Reauth and Psueodnym, see “Pseudonym
Identities” (page 256).
If certain parameters are not specified in the EAP-Type AKA {} configuration block,
default values are assigned. For those parameters that do not have a default value, you
must specify those values to ensure that the capability is supported.
The following rules apply to the EAP-Type AKA{} configuration block parameters:
• The parameter names are case-insensitive.
• For parameters with on and off binary values, the values, enabled, yes, on,
and true are synonymous, and the values, disabled, no, off, and false are
synonymous.
• String parameter values must be enclosed within single or double quotes.
The EAP-Type AKA{} configuration block can contain any subset, including empty
subsets. The EAP.authfile configuration parameters are described in Table 17-5.
Table 17-5 EAP.authfile Configuration Parameters
DescriptionParameter
Specifies the default AKA algorithm for the realm.
If the profile for a user in this realm does not specify
AKA Algorithm
an AKA algorithm, and if an AKA algorithm is
needed to produce the AKA vector for this user's
authentication, the AKA algorithm specified by this
parameter is used. For information on available
algorithms, see “Generating Authentication Vectors
Using A3, A8, and AKA Algorithms” (page 268).
There is no default value.
Indicates whether the server must accept permanent
identities of the form 0 + IMSI, for this realm.
Prefixed-IMSI-Permanent-IDs
EAP-AKA RFC 4187 indicates that the permanent
identity must be derived from the IMSI. However,
an implementation may choose a permanent
identity that is not based on IMSI. The server
supports both options.
The valid values are Enabled and Disabled.
The default value is Enabled.
Indicates whether the server must accept generic
permanent identities that are not based on an IMSI,
for this realm. For example, fred.
Generic-Permanent-IDs
242 Configuring EAP-SIM and EAP-AKA Authentication Methods