EAP_ATTRIBUTE_TYPE (Compact 7)

Article
08/17/2015

3/12/2014

This enumeration defines the set of possible EAP attribute types that are available on an authenticating entity.

Additional details for values in this enumerated type are obtained by referring to one of the following references: RFC 2865, RFC 2866, RFC 2869, RFC 2868, RFC 3162, RFC 3579, or RFC 3580.

Syntax

typedef enum  {
  eatMinimum = 0,
  eatUserName = 1,
  eatUserPassword = 2,
  eatMD5CHAPPassword = 3,
  eatNASIPAddress = 4,
  eatNASport = 5,
  eatServiceType = 6,
  eatFramedProtocol = 7,
  eatFramedIPAddress = 8,
  eatFramedIPNetmask = 9,
  eatFramedRouting = 10,
  eatFilterId = 11,
  eatFramedMTUeatFramedMTU = 12,
  eatFramedCompression = 13,
  eatLoginIPHost = 14,
  eatLoginService = 15,
  eatLoginTCPPort = 16,
  eatUnassigned17 = 17,
  eatReplyMessage = 18,
  eatCallbackNumber = 19,
  eatCallbackId = 20,
  eatUnassigned21 = 21,
  eatFramedRout = 22,
  eatFramedIPXNetwork = 23,
  eatState = 24,
  eatClass = 25,
  eatVendorSpecific = 26,
  eatSessionTimeout = 27,
  eatIdleTimeout = 28,
  eatTerminationAction = 29,
  eatCalledStationId = 30,
  eatCallingStationId = 31,
  eatNASIdentifier = 32,
  eatProxyState = 33,
  eatLoginLATService = 34,
  eatLoginLATNode = 35,
  eatLoginLATGroup = 36,
  eatFramedAppleTalkLink = 37,
  eatFramedAppleTalkNetwork = 38,
  eatFramedAppleTalkNetwork = 38,
  eatFramedAppleTalkZone = 39,
  eatAcctStatusType = 40,
  eatAcctDelayTime = 41,
  eatAcctInputOctets = 42,
  eatAcctOutputOctets = 43,
  eatAcctSessionId = 44,
  eatAcctAuthentic = 45,
  eatAcctSessionTime = 46,
  eatAcctInputPackets = 47,
  eatAcctOutputPackets = 48,
  eatAcctTerminateCause = 49,
  eatAcctMultiSessionId = 50,
  eatAcctLinkCount = 51,
  eatAcctEventTimeStamp = 55,
  eatMD5CHAPChallenge = 60,
  eatNASPortType = 61,
  eatPortLimit = 62,
  eatLoginLATPort = 63,
  eatTunnelType = 64,
  eatTunnelMediumTyp = 65,
  eatTunnelClientEndpoint = 66,
  eatTunnelServerEndpoint = 67,
  eatARAPPassword = 70,
  eatARAPFeatures = 71,
  eatARAPZoneAccess = 72,
  eatARAPSecurity = 73,
  eatARAPSecurityData = 74,
  eatPasswordRetry = 75,
  eatPrompt = 76,
  eatConnectInfo = 77,
  eatConfigurationToken = 78,
  eatEAPMessage = 79,
  eatSignature = 80,
  eatARAPChallengeResponse = 84,
  eatAcctInterimInterval = 85,
  eatNASIPv6Address = 95,
  eatFramedInterfaceId = 96,
  eatFramedIPv6Prefix = 97,
  eatLoginIPv6Host = 98,
  eatFramedIPv6Route = 99,
  eatFramedIPv6Pool = 100,
  eatARAPGuestLogon = 8096,
  eatCertificateOID = 8097,
  eatEAPConfiguration = 8098,
  eatPEAPEmbeddedEAPTypeId = 8099,
  eatPEAPFastRoamedSession = 8100,
  eatEAPTLV = 8102,
  eatCredentialsChanged = 8103,
  eatInnerEapMethodType = 8104,
  eatClearTextPassword = 8107,
  eatQuarantineSoH = 8150,
  eatPeerId = 9000,
  eatServerId = 9001,
  eatMethodId = 9002,
  eatEMSKeatEMSK= 9003,
  eatSessionId = 9004,
  eatReserved = 0xFFFFFFFF
} EAP_ATTRIBUTE_TYPE,  
EapAttributeType;

Constants

eatMinimum
Specifies a value equal to zero, and used as the NULL terminator in any array of EAP_ATTRIBUTE structures.

This attribute type is consumed by PPP client supplicants.

eatUserName
Specifies the name of the user to be authenticated. This attribute type is also used when the user's password is changed. For Routing and Remote Access Service (RRAS) authentication sessions, the identity string (name) of the authenticating user is sent to IAS as part of the request attributes. The pValue member of EAP_ATTRIBUTE for this type points to a multibyte string without a NULL termination character.

This attribute type is exported by MS-CHAPv2 methods and by PEAP methods. It is consumed by PPP server supplicants.

eatUserPassword
Specifies the password of the user to be authenticated. The pValue member of EAP_ATTRIBUTE for this type points to a byte string.

eatMD5CHAPPassword
Specifies the password provided by the user in response to an MD5 Challenge Handshake Authentication Protocol (CHAP) challenge. The pValue member of EAP_ATTRIBUTE for this type points to a byte string.

eatNASIPAddress
Specifies the IP address of the Network Access Server (NAS) that is requesting user authentication. An Access-Request should specify either an NAS IP address or an NAS identifier. The pValue member of EAP_ATTRIBUTE for this type points to a byte string.

eatNASport
Specifies the physical or virtual private network (VPN) through which the user is connecting to the NAS. Notice that this value is not a port number in the sense of TCP or UDP. The pValue member of EAP_ATTRIBUTE for this type points to a byte string.

eatServiceType
Specifies the type of service the user has requested or the type of service to be provided. The pValue member of EAP_ATTRIBUTE for this type points to a byte string.

eatFramedProtocol
Specifies the type of framed protocol to use for framed access, for example SLIP, PPP, or ARAP (AppleTalk Remote Access Protocol). The pValue member of EAP_ATTRIBUTE for this type points to a byte string.

eatFramedIPAddress
Specifies the IP address that is configured for the user requesting authentication. This attribute is typically returned by the authentication provider. However, the NAS may use it in an authentication request to specify a preferred IP address. The pValue member of EAP_ATTRIBUTE for this type points to a byte string.

eatFramedIPNetmask
Specifies the IP network mask for a user that is a router to a network.

This attribute type is not used by EAPHost methods or supplicants.

eatFramedRouting
Specifies the routing method for a user that is a router to a network.

This attribute type is not used by EAPHost methods or supplicants.

eatFilterId
Specifies the name of the filter list for the user requesting authentication. The pValue member of EAP_ATTRIBUTE for this type points to a byte string.

eatFramedMTU
Specifies the Maximum Transmission Unit (MTU) for the user. This attribute is used if the MTU is not negotiated through some another way, such as PPP. The pValue member of EAP_ATTRIBUTE for this type points to a byte string.

eatFramedCompression
Specifies a compression protocol to use for the connection.

This attribute type is not used by EAPHost methods or supplicants.

eatLoginIPHost
Specifies the system with which to connect the user.

This attribute type is not used by EAPHost methods or supplicants.

eatLoginService
Specifies the service to use to connect the user to the host specified by eatLoginIPHost.

This attribute type is not used by EAPHost methods or supplicants.

eatLoginTCPPort
Specifies the port to which to connect the user. This attribute is present only if the eatLoginService attribute is present.

This attribute type is not used by EAPHost methods or supplicants.

eatUnassigned17
This value is currently unassigned

This attribute type is not used by EAPHost methods or supplicants.

eatReplyMessage
Specifies a message to display to the user. The pValue member of EAP_ATTRIBUTE for this type points to a byte string.

This attribute type consumed by the PPP server supplicant. This attribute type should not be used by any other method or supplicant. eatEAPMessage should be used to sent displayable messages whenever possible.

eatCallbackNumber
Specifies a callback number. The pValue member of EAP_ATTRIBUTE for this type points to a byte string.

eatCallbackId
Specifies a location to call back. The value of this attribute is interpreted by the NAS. The pValue member of EAP_ATTRIBUTE for this type points to a byte string.

eatUnassigned21
This value is currently unassigned.

This attribute type is not used by EAPHost methods or supplicants.

eatFramedRoute
Specifies routing information to configure on the NAS for the user.

This attribute type is not used by EAPHost methods or supplicants.

eatFramedIPXNetwork
Specifies the IPX network number to configure for the user.

This attribute type is not used by EAPHost methods or supplicants.

eatState
Specifies state information that is provided to the client by the server. For RRAS authentication sessions, if authentication completed successfully and IAS returned attributes, this state information is saved and used as input when constructing the request attributes for IAS during the next packet cycle. The pValue member of EAP_ATTRIBUTE for this type points to a byte string. Refer to RFC 2865 for detailed information about this value.

This attribute type is consumed by PPP server supplicants.

eatClass
Specifies a value that is provided to the NAS by the authentication provider. The NAS should use this value when communicating with the accounting provider. The pValue member of EAP_ATTRIBUTE for this type points to a byte string.

eatVendorSpecific
Specifies a field for vendor-supplied extended attributes.

This field is used to store Microsoft Point-to-Point Encryption (MPPE) keys consumed by the 802.1X supplicant.

The following table shows the structure of the data pointed to by the pValue member of EAP_ATTRIBUTE for this type.

First Byte	Last Byte	Description
0	3	Length: 4 bytes The vendor identifier. This field always has a value of 311.
4	4	Length: 1 byte The type of MPPE key. If the attribute refers to a MPPE send key, this field has a value of 16. If the attribute refers to a MPPE receive key, this field has a value of 17.
5	5	Length: 1 byte The MPPE vendor-specific attribute length. This field always has a value of 52.
6	7	Length: 2 bytes Salt. This field always has a value of 0.
8	8	Length: 1 byte The MPPE key length. This field always has a value of 32.
9	40	Length: 32 bytes The MPPE key. The field contents are as follows: For MPPE send keys used on a client, this field contains the first 32 bytes (bytes 0-31) of the master session key (MSK). For MPPE send keys used on a server, this field contains the second 32 bytes (bytes 32-63) of the MSK. For MPPE receive keys used on a client, this field contains the second 32 bytes (bytes 32-63) of the MSK. For MPPE receive keys used on a server, this field contains the first 32 bytes (bytes 0-31) of the MSK.
41	55	Length: 15 bytes Padding.

This attribute type is consumed by 802.1X supplicants.

eatSessionTimeout
Specifies the maximum number of seconds for which to provide service to the user. After this time, the session is terminated. The pValue member of EAP_ATTRIBUTE for this type points to a byte string.

This attribute type is typically used by EAP methods to set the time-out duration for authentication inside an Access-Challenge packet. The duration of the time-out is determined by IAS, not the EAP method.

For RRAS authentication sessions, if authentication succeeded and there is a pending packet to be sent, the packet is sent with an interactive time-out if the corresponding eatSessionTimeout value is greater than 10.

This attribute type is consumed by PPP server supplicants.

eatIdleTimeout
Specifies the maximum number of consecutive seconds the session can be idle. If the idle time exceeds this value, the session is terminated.

This attribute type is not used by EAPHost methods or supplicants.

eatTerminationAction
Specifies an action the server performs when time that the connection terminates. Refer to the above-referenced files for detailed information about this value.

This attribute type is not used by EAPHost methods or supplicants.

eatCalledStationId
Specifies the telephone number called by using Dialed Number Identification (DNIS) or similar technology. The telephone number called by the user may differ from the telephone number from which the call originated. This attribute type may also be used to store other types of information, such as MAC addresses. The pValue member of EAP_ATTRIBUTE for this type points to a byte string.

eatCallingStationId
Specifies the originating telephone number for a call, by using Automatic Number Identification (ANI) or similar technology. This attribute type may also be used to store other types of information, such as MAC addresses. The pValue member of EAP_ATTRIBUTE for this type points to a byte string.

eatNASIdentifier
Specifies the NAS identifier. An Access-Request should specify either an NAS identifier or an NAS IP address. The pValue member of EAP_ATTRIBUTE for this type points to a byte string.

eatProxyState
Specifies a value that a proxy server includes when forwarding an authentication request.

This attribute type is not used by EAPHost methods or supplicants.

eatLoginLATService
Not used.

eatLoginLATNode
Not used.

eatLoginLATGroup
Not used.

eatFramedAppleTalkLink
Specifies the AppleTalk network number for the user when the user is another router.

This attribute type is not used by EAPHost methods or supplicants.

eatFramedAppleTalkNetwork
Specifies the AppleTalk network number that the NAS should use to allocate an AppleTalk node for the user. This attribute is used only when the user is not another router.

This attribute type is not used by EAPHost methods or supplicants.

eatFramedAppleTalkZone
Specifies the AppleTalk default zone for the user.

This attribute type is not used by EAPHost methods or supplicants.

eatAcctStatusType
Specifies whether the accounting provider should start or stop accounting for the user.

This attribute type is not used by EAPHost methods or supplicants.

eatAcctDelayTime
Specifies the length of time that the client has been attempting to send the current request.

This attribute type is not used by EAPHost methods or supplicants.

eatAcctInputOctets
Specifies the number of octets that have been received during the current accounting session.

This attribute type is not used by EAPHost methods or supplicants.

eatAcctOutputOctets
Specifies the number of octets that were sent during the current accounting session.

This attribute type is not used by EAPHost methods or supplicants.

eatAcctSessionId
Specifies a value to enable the identification of matching start and stop records within a log file.

This attribute type is not used by EAPHost methods or supplicants.

eatAcctAuthentic
Specifies, to the accounting provider, how the user was authenticated; for example by Directory Services, RADIUS, or some other authentication provider.

This attribute type is not used by EAPHost methods or supplicants.

eatAcctSessionTime
Specifies the number of seconds that have elapsed in the current accounting session.

This attribute type is not used by EAPHost methods or supplicants.

eatAcctInputPackets
Specifies the number of packets that have been received during the current accounting session.

This attribute type is not used by EAPHost methods or supplicants.

eatAcctOutputPackets
Specifies the number of packets that have been sent during the current accounting session.

This attribute type is not used by EAPHost methods or supplicants.

eatAcctTerminateCause
Specifies how the current accounting session was terminated.

This attribute type is not used by EAPHost methods or supplicants.

eatAcctMultiSessionId
Specifies a value to enable the identification of related accounting sessions within a log file.

This attribute type is not used by EAPHost methods or supplicants.

eatAcctLinkCount
Specifies the number of links if the current accounting session is using a multilink connection.

This attribute type is not used by EAPHost methods or supplicants.

eatAcctEventTimeStamp
Specifies an attribute that is included in an accounting request packet. It specifies the time that the event occurred.

This attribute type is not used by EAPHost methods or supplicants.

eatMD5CHAPChallenge
Specifies the CHAP challenge sent by the NAS to a CHAP user.

This attribute type is not used by EAPHost methods or supplicants.

eatNASPortType
Specifies the type of the port through which NAS is authenticating the user, for example, asynchronous, ISDN, virtual. The pValue member of EAP_ATTRIBUTE for this type points to a byte string.

eatPortLimit
Specifies the number of ports the NAS should make available to the user for multilink sessions.

This attribute type is not used by EAPHost methods or supplicants.

eatLoginLATPort
Not used.

eatTunnelType
Specifies the tunneling protocol that is used.

This attribute type is not used by EAPHost methods or supplicants.

eatTunnelMediumType
Specifies which transport medium to use when it creates a tunnel for those protocols (such as L2TP) that can operate over multiple transports.

This attribute type is not used by EAPHost methods or supplicants.

eatTunnelClientEndpoint
Points to the address of the initiator end of the tunnel.

This attribute type is not used by EAPHost methods or supplicants.

eatTunnelServerEndpoint
Points to the address of the server end of the tunnel.

This attribute type is not used by EAPHost methods or supplicants.

eatARAPPassword
Specifies a password to use for AppleTalk Remote Access Protocol (ARAP) authentication.

This attribute type is not used by EAPHost methods or supplicants.

eatARAPFeatures
Specifies information that an NAS should send back to the user in an ARAP "feature flags" packet.

This attribute type is not used by EAPHost methods or supplicants.

eatARAPZoneAccess
Specifies how to use the ARAP zone list for the user.

This attribute type is not used by EAPHost methods or supplicants.

eatARAPSecurity
Specifies an ARAP security module to use during a secondary authentication phase between the NAS and the user.

This attribute type is not used by EAPHost methods or supplicants.

eatARAPSecurityData
Specifies the data to use with an ARAP security module.

This attribute type is not used by EAPHost methods or supplicants.

eatPasswordRetry
Specifies the number of password retry tries to allow the user access. This attribute type is deprecated for EAP and RADIUS/EAP.

This attribute type is not used by EAPHost methods or supplicants.

eatPrompt
Specifies whether the NAS should echo the user response to a challenge.

This attribute type is not used by EAPHost methods or supplicants.

eatConnectInfo
Specifies information about the type of connection the user is using.

This attribute type is not used by EAPHost methods or supplicants.

eatConfigurationToken
Specifies user-profile information in communications between RADIUS Proxy Servers and RADIUS Proxy Clients.

This attribute type is not used by EAPHost methods or supplicants.

eatEAPMessage
Specifies that EAP information be sent directly between the user and the authentication provider. For RRAS authentication sessions, this attribute type is used to retrieve the EAP message from the authenticator and send the message to the client. The pValue member of EAP_ATTRIBUTE for this type points to a byte string.

This attribute type is consumed by PPP server supplicants.

eatSignature
Specifies a signature to include with CHAP, EAP, or ARAP packets.

This attribute type is not used by EAPHost methods or supplicants.

eatARAPChallengeResponse
Specifies the response to a Apple Remote Access Protocol (ARAP) challenge. In ARAP, either the server or the client may respond to challenges.

This attribute type is not used by EAPHost methods or supplicants.

eatAcctInterimInterval
Specifies the time, in seconds, between accounting updates.

This attribute type is not used by EAPHost methods or supplicants.

eatNASIPv6Address
The IPv6 address of the NAS requesting user authentication. This address should be unique to the NAS within the scope of the RADIUS server. The pValue member of EAP_ATTRIBUTE for this type points to a byte string.

eatFramedInterfaceId
The IPv6 interface identifier to be configured for the user. The pValue member of EAP_ATTRIBUTE for this type points to a byte string.

eatFramedIPv6Prefix
The IPv6 prefix (and corresponding route) to be configured for the user. The pValue member of EAP_ATTRIBUTE for this type points to a byte string.

eatLoginIPv6Host
Not used.

eatFramedIPv6Route
Not used.

eatFramedIPv6Pool
Not used.

eatARAPGuestLogon
Specifies a Apple Remote Access Protocol (ARAP) guest logon.

This attribute type is not used by EAPHost methods or supplicants.

eatEAPConfiguration
Not used.

eatPEAPEmbeddedEAPTypeId
The identifier of the inner EAP method that is used in PEAP authentication. The pValue member of EAP_ATTRIBUTE for this type points to a DWORD. Only the least significant byte of the DWORD is meaningful.

This attribute type is exported by PEAP methods and is not consumed by any supplicant.

eatPEAPFastRoamedSession
Specifies whether PEAP fast reconnect is used by the authenticator. The pValue member of EAP_ATTRIBUTE for this type points to a DWORD. If pValue points to 0, fast reconnect is not used by the authenticator. If pValue points to a nonzero value, fast reconnect is used by the authenticator.

This attribute type is exported by PEAP methods and consumed by PPP client supplicants.

eatCredentialsChanged
Specifies whether credentials have changed during EAP authentication. The pValue member of EAP_ATTRIBUTE for this type points to a DWORD. If pValue points to 0, the credentials have not changed. If pValue points to a nonzero value, credentials have changed.

This attribute type may be exported by MS-CHAPv2 methods, and is consumed by PPP client supplicants.

eatInnerEapMethodType
The inner EAP method that is used inside native tunnel methods. The pValue member of EAP_ATTRIBUTE for this type points to an EAP_METHOD_TYPE structure.

This attribute type is exported by EAP methods.

eatClearTextPassword
The password, in clear text, of the user to be authenticated. This attribute type is sent by EAP methods that use EAPHost to raise the identity user interface. The pValue member of EAP_ATTRIBUTE for this type points to an EAP_METHOD_TYPE structure.

This attribute type is exported by EAPHost.

eatQuarantineSoH
Contains SoH request and response information that is used during EAP authentication. The pValue member of EAP_ATTRIBUTE for this type points to a byte string.

This attribute type is exported by EAPHost and PEAP methods, and consumed by PPP server supplicants.

eatPeerId
The peer identity provided in the identity response message (EAP-Response/Identity). This identity may differ from the peer identity authenticated by the EAP method. The pValue member of EAP_ATTRIBUTE for this type points to an ASCII string. The string will be NULL if the EAP peer identity does not exist. For more information, see the Key Management Framework draft specification at this Internet Engineering Task Force (IETF) Web site.

This attribute type is exported by EAP methods and consumed by supplicants.

eatServerId
The identity of the server that is used when the EAP method authenticates to the server. The pValue member of EAP_ATTRIBUTE for this type points to an ASCII string. The string will be NULL if an EAP method does not define a method-specific peer identity. For more information, see the Key Management Framework draft specification at this Internet Engineering Task Force (IETF) Web site.

This attribute type is exported by EAP methods and consumed by supplicants.

eatMethodId
A temporally unique method identifier that identifies an EAP session of a given type between an peer and a server. Any EAP method that derives keys must specify this attribute type. The pValue member of EAP_ATTRIBUTE for this type points to a DWORD. For more information, see the Key Management Framework draft specification at this Internet Engineering Task Force (IETF) Web site.

This attribute type is exported by EAPHost methods and other EAP methods, and consumed by supplicants.

eatEMSK
The extended session master key (EMSK). This key material is derived between the peer and the server, and should not be shared with a third-party. The pValue member of EAP_ATTRIBUTE for this type points to a byte string, that should contain at least 64 octets of key material. For more information, see the Key Management Framework draft specification at this Internet Engineering Task Force (IETF) Web site.

This attribute type is exported by EAP methods and consumed by supplicants.

eatSessionId
An attribute type which carries the session identity

eatReserved
Not used.

Share via

EAP_ATTRIBUTE_TYPE (Compact 7)

Syntax

Constants

See Also

Reference

Additional resources