Subject: Re: [AAA-WG]: separated authorization and accounting servers? (resend, sorry if you get this twice...)

From: James Kempf <[email-masked]>
Date: Wed, 18 Apr 2001 08:41:51 -0700 (PDT)

Jari,

Certainly in the API there is support for a client to have multiple
sessions open with different servers. This would allow accounting
transactions with a different server than authorization.

		jak

>Delivered-To: [email-masked]
>Date: Wed, 18 Apr 2001 11:43:51 +0300
>From: Jari Arkko <[email-masked]>
>To: [email-masked]
>Subject: [AAA-WG]: separated authorization and accounting servers? (resend, 
sorry if you  get this twice...)
>
>
>Hello,
>
>We've been trying to figure out if the current
>version of the Diameter specs allow accounting
>and other traffic to be directed to different
>servers. Traditionally, we've had this feature
>in RADIUS. It might even be conceivable that there
>be uses of accounting where there is no authentication
>or authorization at all on a node that gives a service.
>
>But can we do this? We haven't figured out if the
>specifications say anything about this. Section 13.1
>talks about authorization server directed model, but
>I would classify the "direction" as optional information.
>Section 13.2 says servers that receive a succesfull
>authentication response must collect accounting information.
>But must they send it too? And can there be other nodes
>that would not perform authentication/authorization but
>who still produce accounting information (e.g. for
>trend analysis purposes)? Section 11 talks about user
>sessions and their life-cycle. But it doesn't seem to
>state anything about this issue in particular.
>
>Do we allow two proxies to be configured for a client
>node, one for the authentication and authorization, and
>the second one for accounting?
>
>And whatever we say, why are we saying so?
>
>Jari
>