Subject: [AAA-WG]: Re: DIAMETER Base Protocol (Alpha 1) - Comments Section 3.0

From: "Martin Julien (ECE)" <[email-masked]>
Date: Tue, 23 Jan 2001 08:31:23 +0100

See enclosed comments.

> -----Original Message-----
> From: Pat Calhoun [mailto:[email-masked]]
> Sent: Monday, January 22, 2001 6:11 PM
> > 
> > > From: Pat Calhoun [mailto:[email-masked]]
> > > Sent: Monday, January 22, 2001 4:39 PM
> > >
> > > > > > Section 3.5.2
> > > > > > -------------
> > > > > > What the Resource-Owner-NAI AVP used for in the STR? Is it 
> > > > > for routing? I
> > > > > > guess not, since the User-Name AVP is present. Can it be 
> > > > > used in the server
> > > > > > for any particular reason I don't see, since I think the 
> > > > > active session
> > > > > > should be aware of what's going on within itself, right?
> > > > > 
> > > > > If the home server wishes for the NAS to reliquish 
> > > resources, then the
> > > > > User-name AVP doesn't really help since it would cause the 
> > > > > packet to get
> > > > > routed to the home server (loop). So something is needed for 
> > > > > the message to
> > > > > get routed to the NAS, and I envisioned was that the AVP 
> > > > > would be used for
> > > > > routing purposes (and eventually get to the NAS).
> > > > 
> > > > Then, are you telling me that the message routing can be 
> > > done using other
> > > > AVPs than the Routing-Realm AVP and the User-Name AVP? 
> > > Also, is it really
> > > > needed in the STR, which is sent from the access device to 
> > > the Home AAA?
> > > 
> > > In the STR no, only in the STI. Can anyone think of a better 
> > > mechanism? I
> > > really don't know of a better way to do this.
> > 
> > Shouldn't we use the Routing-Realm AVP in order to reach 
> the access device?
> > Then, would you obsolete the Resource-Owner-NAI AVP, or do 
> you see any
> > further need for it? 
> > 
> > My understanding was that the Routing-Realm AVP was the 
> destination of the
> > message, as it is routed through the network, and the 
> Host-Name AVP the
> > originator of the message, which should never change during 
> the message
> > transit to its final destination. However, what could cause 
> problems is the
> > fact that some proxies might modify the Routing-Realm AVP 
> in transit, right?
> 
> I didn't think that Routing-Realm would pin point a 
> particular NAS, but rather
> the domain that it happens to be in. Isn't this your 
> understanding as well?
> 
> PatC
> 

That was my initial understanding until I find out that the Destination-NAI AVP was removed from the Base Protocol. Now, I'm wondering how a re-authentication message can reach the same Host-Server if there is no Destination-NAI AVP in which put the Host-Name AVP of the Home AAA received in the first Authentication response? I thought possible to have several Home servers for the same realm, but since the Destination-NAI AVP was gone, I thought that it would not be possible anymore, unless they all share information about the user session. Could someone help me on that?

---

From: Pat Calhoun <[email-masked]>
Date: Tue, 23 Jan 2001 07:30:18 -0800 (PST)

> That was my initial understanding until I find out that the Destination-NAI
> AVP was removed from the Base Protocol. Now, I'm wondering how a
> re-authentication message can reach the same Host-Server if there is no
> Destination-NAI AVP in which put the Host-Name AVP of the Home AAA received
> in the first Authentication response? I thought possible to have several
> Home servers for the same realm, but since the Destination-NAI AVP was gone,
> I thought that it would not be possible anymore, unless they all share
> information about the user session. Could someone help me on that?

sigh.

Well I guess in my haste to remove support for different reverse path routing,
I removed an AVP that had additional uses. So, it looks like Destination-NAI
needs to be put back in, but with a much more limited set of functionality. It
will now ONLY be used to identify the host within the domain. The
Routing-Realm AVP is still used to identify the Domain, and once a server
identifies that the message made it to the destination realm, the
Destination-NAI is used to route to a specific host.

This means that the Resource-Owner-NAI is gone.

This seems to work for reverse re-auth *and* termination messages.

Comments?

PatC

---

From: Tony Johansson <[email-masked]>
Date: Tue, 23 Jan 2001 11:48:44 -0800

Hi Pat,

See comments embedded....

BR,

/Tony

> sigh.

Well, first of all the Destination-NAI AVP was never intended to be used as
described above, right?!. The Host-Name contains the originating host (i.e. the
NAS or the FA) and the Host-Name AVP was copied into the Destination-NAI AVP for
the return trip. The Destination-NAI AVP was then used to route the reply message
back to the originating host. Correct ?

> I removed an AVP that had additional uses.

What additional uses do you recall ?

> So, it looks like Destination-NAI

I'm not sure that I understand why we need this. Is it to allow a NAS or an FA to
always target the same home AAA server in case there is more then one?
Furthermore, could you please tell me why this is really needed and if so, be a
little bit more specific how this should be done. I'm under the assumption that if
you have more than one AAA server in the same domain, you would have access to a
shared database, thus a re-authentication arriving at a different home AAA server
can be handled. Correct? Or is there any reason to argue otherwise?

---

From: Pat Calhoun <[email-masked]>
Date: Tue, 23 Jan 2001 11:54:51 -0800 (PST)

> described above, right?!. The Host-Name contains the originating host (i.e.
> the NAS or the FA) and the Host-Name AVP was copied into the Destination-NAI
> AVP for the return trip. The Destination-NAI AVP was then used to route the
> reply message back to the originating host. Correct ?

correct, it was used for inter-domain routing.

> What additional uses do you recall ?

see below.

> I'm not sure that I understand why we need this. Is it to allow a NAS or an
> FA to always target the same home AAA server in case there is more then one?
> Furthermore, could you please tell me why this is really needed and if so,
> be a little bit more specific how this should be done. I'm under the
> assumption that if you have more than one AAA server in the same domain, you
> would have access to a shared database, thus a re-authentication arriving at
> a different home AAA server can be handled. Correct? Or is there any reason
> to argue otherwise?

There are two uses that I can think of, both of which involve home server
initiated messages: - The home server wishes to send an STI to the NAS, to
force the session to be disconnected, and - The home server wishes to send a
re-auth request to the NAS.

Is this clearer?

PatC

---

From: Pat Calhoun <[email-masked]>
Date: Tue, 23 Jan 2001 12:00:16 -0800 (PST)

Re-reading this, it isn't that clear that I fully communicated the use of the
proposed new AVP. See more below. > 
> re-auth request to the NAS.
The existing proxying techniques are still used, and we are not proposing
changing these. However, some AVP must be set to identify the actual NAS (or
server) within the domain. This new AVP would ONLY be used to identify a NAS
(or server) within a domain.

PatC

---

From: Tony Johansson <[email-masked]>
Date: Tue, 23 Jan 2001 13:06:12 -0800

Hi Pat,

True, for the cases of home server initiated messages, like STI and re-auth
request to the NAS, we do need some thing to route the message to the right NAS or
FA and the AVP for that is the Resource-Owner-NAI AVP. Correct? If the idea here
is only to change the name from Resource-Owner-NAI AVP to Destination-NAI AVP, it
is fine with me.

Furthermore, just as clarification, if the case is to change the
Resource-Owner-NAI AVP to the Destination-NAI AVP it should stated in the text
that the Destination-NAI AVP should ONLY be used for messages originated from the
AAA server. Correct?

BR,

/Tony

---

From: Pat Calhoun <[email-masked]>
Date: Tue, 23 Jan 2001 13:10:10 -0800 (PST)

> request to the NAS, we do need some thing to route the message to the right
> NAS or FA and the AVP for that is the Resource-Owner-NAI AVP. Correct? If
> the idea here is only to change the name from Resource-Owner-NAI AVP to
> Destination-NAI AVP, it is fine with me.

yes, the issue is that the REsource-Owner-NAI is tied to ST* messages. We need
something that can be used with re-auth as well. Destination-NAI is one name
we could use.

> Resource-Owner-NAI AVP to the Destination-NAI AVP it should stated in the
> text that the Destination-NAI AVP should ONLY be used for messages
> originated from the AAA server. Correct?

Correct. If that is the case, perhaps NAS-NAI is more appropriate.

PatC

---

From: Tony Johansson <[email-masked]>
Date: Tue, 23 Jan 2001 14:59:18 -0800

I would prefer Destination-NAI AVP or something similar, thus a more general name,
which works well for both a NAS (with re-auth and ST* messages) or an FA (with ST*
messages).

BR,

/Tony

--
_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_

  Tony Johansson
  Mobile Networking Research
  Ericsson Inc.    mobile: +1 510 305 6108
  2100 Shattuck Avenue
  Berkeley, CA, 94704
                         mailto:[email-masked]
_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_