The usage of the AAA framework with RADIUS [RFC2865] and Diameter [RFC6733] for network access authentication has been successful from a deployment point of view. To map the terminology used in Figure 1 to the AAA framework, the IdP corresponds to the AAA server; the RP corresponds to the AAA client; and the technical building blocks of a federation are AAA proxies, relays, and redirect agents (particularly if they are operated by third parties, such as AAA brokers and clearinghouses). In the case of network access authentication, the front end, i.e., the communication path between the end host and the AAA client, is offered by link-layer protocols that forward