Method and apparatus for determining authentication capabilities

A non-transitory computer-readable storage medium carrying one or more sequences of instructions, which instructions, when executed by one or more processors, cause the one or more processors to perform the steps of:

• sending from an authentication server via the network interface, to a supplicant that is requesting access to a computer network resource subject to authentication of a user of the supplicant, a list of first authentication methods that are supported by the authentication server;
• wherein the first authentication methods are based on authentication requirements for the supplicant;
• receiving at the authentication server via the network interface, from the supplicant, a counter-list of second authentication methods that are supported by the supplicant;
• determining which of the second authentication methods in the counter-list are in the list of the first authentication methods;
• and
• performing an authentication policy action based on which of the second authentication methods are in the list of the first authentication method;
• initiating an authentication message exchange with the supplicant based on one of the first authentication methods that are in the counter-list of second authentication methods;
• if the authentication message exchange is successful and the supplicant is granted access to the computer network reesource, granting one of a plurality of levels of access to the computer network resource based on which of the second authentication methods in the counter-list are in the list of the first authentication methods.

A method comprising the computer-implemented steps of:

• sending from an authentication server via an network interface, to a supplicant that is requesting access to a computer network resource subject to authentication of a user of the supplicant, a list of first authentication methods that are supported by the authentication server;
• wherein the first authentication methods are based on authentication requirements for the supplicant;
• receiving at the authentication server via the network interface, from the supplicant, a counter-list of second authentication methods that are supported by the supplicant;
• determining which of the second authentication methods in the counter-list are in the list of the first authentication methods;
• and performing an authentication policy action based on which of the second authentication methods are in the list of the first authentication method;
• initiating an authentication message exchange with the supplicant based on one of the first authentication methods that are in the counter-list of second authentication methods;
• if the authentication message exchange is successful and the supplicant is granted access to the computer network resource, granting one of a plurality of levels of access to the computer network resource based on which of the second authentication methods in the counter-list are in the list of the first authentication methods;
• wherein the method is performed by one or more processors.