Subject: [AAA-WG]: Issue 55: Server-Initiated re-auth

From: Pat Calhoun <[email-masked]>
Date: Thu, 14 Jun 2001 07:33:06 -0700

All,

Here is an attempt at solving this particular issue. The proposed text below
would appear in the base protocol.

Comments appreciated,

PatC
----

10.15  Server-Initiated Re-Auth

   A Diameter server may initiate a re-authentication and/or re-
   authorization service for a particular session by issuing a Re-Auth-
   Request (RAR).

   For example, for pre-paid services, the Diameter server that
   originally authorized a session may need some confirmation that the
   user is still using the services.

   An access device that receives a RAR message with Session-Id equal to
   a currently active session MUST initiate a re-auth towards the user,
   if the service supports this particular feature. Each Diameter
   application MUST state whether service-initiated re-auth is
   supported, since some applications do not allow for access devices to
   prompt the user for re-auth.

10.15.1  Re-Auth-Request

   The Re-Auth-Request (RAR), indicated by the Command-Code set to TBD
   and the message flags' 'R' bit set, may be sent by any server to the
   access device that is providing session service, to request that the
   user be re-authenticated and/or re-authorized.

   Message Format

      <Re-Auth-Request>  ::= < Diameter Header: TBD, REQUEST >
                             < Session-Id >
                             { Origin-Host }
                             { Origin-Realm }
                             { Destination-Realm }
                             { Destination-Host }
                             [ Origin-State-Id ]
                           * [ AVP ]
                           * [ Proxy-Info ]
                           * [ Route-Record ]

10.15.2  Re-Auth-Answer

   The Re-Auth-Answer (RAA), indicated by the Command-Code set to TBD
   and the message flags' 'R' bit clear, is sent in response to the RAR.
   The Result-Code AVP MUST be present, and indicates the disposition of
   the request.

   A successful RAA message MUST be followed by an application-specific
   authentication and/or authorization message.

   Message Format

      <Re-Auth-Answer>  ::= < Diameter Header: TBD >
                            < Session-Id >
                            { Result-Code }
                            { Origin-Host }
                            { Origin-Realm }
                            { Destination-Host }
                            [ Origin-State-Id ]
                          * [ AVP ]
                          * [ Proxy-Info ]
                          * [ Route-Record ]

---

From: Jacques Caron <[email-masked]>
Date: Thu, 14 Jun 2001 16:56:35 +0200

Hi,

I don't know if there was already discussion on this subject, but I'm 
rather for option 1 in the original issue description, i.e. get rid of it. 
If a server needs period re-auth, let them send an Authorization-Lifetime AVP.

Or did I miss some important reason to keep it?

Just my EUR 0.02.

Jacques.

_________________________________________________________
Do You Yahoo!?
Get your free @yahoo.com address at http://mail.yahoo.com