Why do universities usually have to be certified twice?
The network of higher education institutions often works with a number of operators, and students use the operator’s account to access it. So they have two judgments: the first NETSHELL_AUTH_BILLING system on the school side is authenticated and the second AAA system is validated by the operator.
Scenario one: AAA relays, schools only repeats.
The user Portal requests to send the AAA to the operator AAA, after it has been certified as legitimate. The actual test is done by the operator. The advantage is that it is simple and the side pressure is low; the disadvantage is that the entire network of operators is compromised and schools are less controlled. It suits the operator’s lead, and the school's AAAA is less capable than transmitting.
Scenario two: local AAA plus bras relay, schools retain control
Users request first to complete the first certification in AAA, then successful certification by Portal to Bras, and then transfer BRAS to operator AAA for second review. Schools have independent accreditation capacity here, and operators fail without compromising legitimacy judgement and are more manageable. The cost is that they need BRAS equipment to support a complex scenario.
Scenario III: Double resource access control, no less operator AAA
This scenario is often misunderstood as dependent on operators. No, users are divided into free and fee-based categories, with post-accreditation schools AAAA send different RADIUS parameters to BRAS or AC: free users can only access the campus network and charge users have access to the Internet. The distinction between rights is based on RADIFUS properties, not on operator AAAA. It is appropriate to distinguish between resource access, such as scientific infonets, where it limits access.
Scenario IV: Multi-operator Subregion, Autoroute
The outer network has two to three operators, and the school AAA has a few areas for telecommunications, connectivity, and movement. After Portal and Bras, AAAA have been interactively completed, the school AAA sends its counterpart operator RADIA under an address called BAAA to BRAS, which automatically initiates a second certification from that operator. Schools suitable for multi-operators to coexist and automatically choose their own route by region.
Sub-site supplement: gateway and operator AAA directly connected
In the sub-scene scenario, dialling gateways and operators AAAA are required to communicate directly, not plug in other equipment, all users are certified twice: school RADIAS first determines legality, then the operator AAAA is licensed, and MAC is unconscious during Internet access. There is a hard constraint that dialling gateways must be connected to the operator AAAA or the link is not established. The second certification is not dependent on BRAS, either site I or scenario II on BRAS, scene III on BAAS or AC, and scene IV on BRAS.
How do we choose the four scenarios and where the risks are?
The operator leads the selection scene, school control scenario 2, science resource isolation scenario 3, and multiple operators automatically select the site. In risk, the site operator is out of business; the scene is top priority and BRAS attributes support advance verification; sub-design equipment limits and MAC's unconscious validity are separately assessed. The essence of secondary certification is a separation of authority between schools and operators, and the authentication system simply leaves this set of standard protocols to be used instead of tweaking complex issues.
Four scenarios. You see the complexity at first glance.
View four scenarios together: two-time certification, school transfer only, BRAS non-repealing, operator failure disaster, and simplest realization; scene 2 independent accreditation plus BRAS transmission, legitimacy judgement not affected by operator failure, medium complexity; scene 3 independent certification with access control, use of bras or aAC for access control, more complex; scene 4 independent certification plus regional distribution, BRAS auto-routing, most complicated. Complexity moves up the level of complexity, and school control goes up.
Transport and malfunction: What if the operator hangs up?
The dead end of scene one is the complete school break-up by the operator, so schools can control their need to choose it. AAA from a 24-mile school has its legitimacy judgement and operators fail to do so without falling into total network failure. This requires that the school itself be highly available: heart beat testing, multiple back ends, double engine heat.
Check the list before you choose.
The teacher and operator confirm before doing so: is the school AAAA simply transmitting or independently authenticated? Does the existing BRAS model support the corresponding RADIFUS attributes? Do you want to distinguish between free and fee-based resources? Are there several operators, or do you want to choose a route? Can the dial-up gateway and the operator AAAA be connected? These answers are set, and the scene is naturally off.
Hard constraints on dialling equipment
The fourth and sub-dealings rely on the specific capabilities of BRAS or dial-up gateways, such as the tannel-server-endpoint properties and operator AAA. These are not all equipment supported, but must be nuzen before selection. Harden unsupported equipment into a program, with an uplink necessarily stuck to secondary authentication. So the technical answer to the second certification is that it can be upgraded and stored together, but its availability depends on the integrity of attribute mapping, bonding conditions and retreat programmes, without calling for zero-reform migration directly.