Subject: [AAA-WG]: Issue 77: Possibility for implicit termination of an Authentication or Authorization session.

From: Tony Johansson <[email-masked]>
Date: Mon, 11 Jun 2001 16:45:12 -0700

All,

Here is a new issue.

/Tony

Issue 77:  Possibility for implicit termination of an Authentication or
Authorization session.
Submitter name: Tony Johansson
Submitter email address: [email-masked]
Date first submitted: 2001-06-11
Reference:
Document: Base
Comment type: T
Priority: 1
Section: 10
Rationale/Explanation of issue:
There may be cases where you don't need to store any session information
in the AAA. For example, there may be cases where the access device will
handle all seesion information. Thus, an access device may request
authentication as a one time thing and no further messages would be
needed between the access device and the AAA.

Proposal:
Perhaps a request from the access device SHOULD allow the
Authorization-Lifetime (as a hint to the server). A value of zero
implies that no state should be created, and no STR will be sent. A
value of zero is a one-shot thing (auth once, never hear from me again).

---

From: Pat Calhoun <[email-masked]>
Date: Mon, 11 Jun 2001 17:47:37 -0700

Tony,

This works for me, and including a zero Authorization-Lifetime is a great way
for an access device to signal that it doesn't expect to send additional messages to
the home server. Of course, I *think* that some issues MAY arise if the home server
decides that it wishes to maintain state, so a Result-Code value must also be 
created to allow the server to reject specifically this request (as opposed to some
complicated Failed-AVP processing.

Anyone object to this reasonable request? I can think of quite a few uses.

PatC