Subject: [AAA-WG]: Issue 77: Possibility for implicit termination of an Authentication or Authorization

From: Pat Calhoun <[email-masked]>
Date: Fri, 15 Jun 2001 06:49:54 -0700

All,

Below is the text that I would like to propose to close this issue. It is consistent
with the discussions on the list so far.

Thanks,

PatC
----

10.0  Diameter User Sessions

[...]

   An access device MAY include an Authorization-Lifetime AVP with a
   value of zero to inform the Diameter server that the authorization
   requested will only occur once, and no further auth messages are to
   be sent with this particular session identifier. The Diameter server
   MAY accept the hint from the access device, or it MAY override the
   Authorization-Lifetime in the answer message with a non-zero value.
   By accepting an Authorization-Lifetime with a zero value, the
   Diameter server agrees that it will not receive a indication of
   session termination once service to the user is terminated, and
   therefore cannot maintain state for the session.  Note that a zero
   Authorization-Lifetime MUST NOT be used in subsequent re-
   authorization messages.

[editor's note: below I changed the two pending states to handle the case
where a zero and non-zero authorization lifetime is included in the
authorization message, and a new state called active to handle the
case of a zero authorization-lifetime, which implies no STR. I don't
particularly like Active as a name, but it is better than my previous
attempt, which was limbo :)

10.1  Authorization Session State Machine

[...]
   The following table contains the authorization session state machine.

      State     Event                          Action     New State
      -------------------------------------------------------------
[...]
      Pending   Successful Service-Specific    Grant      Open
                Authorization answer           Access
                received with non-zero
                Authorization-Lifetime

      Pending   Successful Service-Specific    Grant      Active
                Authorization answer           Access
                received with zero
                Authorization-Lifetime

[...]
      Active    Service to user is terminated  Cleanup    Closed

[...]

[editor's note: Below I modified the last sentence in the paragraph]

10.4  Authorization-Lifetime AVP

[...]
   This AVP MAY be provided by the client as a hint of the maximum
   duration that it is willing to accept. However, the server DOES NOT
   have to observe the hint, and MAY return a value that is smaller than
   the hint. A value of zero means that no re-authorization is required,
   and no session termination message will be sent to the Diameter
   server.