Subject: Re: [AAA-WG]: NASREQ Request-Type AVP???

From: Jacques Caron <[email-masked]>
Date: Mon, 11 Jun 2001 10:55:43 +0200

At 10:36 11/06/01, Martin Julien (ECE) wrote:
>Hi,
>
>Looking at the NASREQ Request-Type AVP, I would appreciate if
>someone could give me his interpretation of the following
>possible values for the Request-Type AVP.
>
> >>
>       AUTHENTICATE_ONLY          1
>          The request being sent is for authentication only, and MUST
>          contain the relevant authentication AVPs that are needed by the
>          Diameter server to authenticate the user.
><<
>
>Since the specification says that it should not be permitted to
>authenticate-only a session, and then authorize-only the same session,
>I was wondering for what that value could really be useful?
>Should that Request-Type value be only used when answering a AA-Request
>Challenge?

The nasreq draft indeed says in 3.1.1:
    It is possible for a single session to be authorized only first, then
    followed by an authentication request. However, the inverse SHOULD
    NOT be permitted.

I quite think that somebody meant the opposite (e.g. TAC+ to Diameter 
gateway where authentication and authorization are two different steps, 
done in that order). On cannot authorize a user which hasn't been 
authenticated yet.

The other possibility is that some authorization is granted first (e.g. 
based on calling/called numbers to authorize a NAS to accept an ISDN call), 
then authentication and authorization again (using PPP and some PPP 
authentication method). But I'm not quite sure both would be linked to the 
same session, actually, since it would be two different services?

Jacques.

_________________________________________________________
Do You Yahoo!?
Get your free @yahoo.com address at http://mail.yahoo.com

---

From: David Mitton <[email-masked]>
Date: Mon, 11 Jun 2001 16:50:42 -0400

>done in that order). On cannot authorize a user which hasn't been 

well, yes you could.  You could authorize anonymous users, or that they 
know the called phone number.  And once you know more about them, revise 
that authorization.

But I've never understood this text distinction either.
But some argue that there is even some degenerate form of authentication 
buried in there.

>based on calling/called numbers to authorize a NAS to accept an ISDN 
>call), then authentication and authorization again (using PPP and some PPP 

Not on most providers I know of.
The authorization based on called/calling numbers is just incompletete, 
until the later information is available.  All the overhead of the call is 
going to get factored into the billing for that user.

Dave.

----------------------------------------------------
David Mitton                            978-288-4570
Advisor, Nortel Networks
[email-masked]   or      [email-masked]

---

From: Pat Calhoun <[email-masked]>
Date: Tue, 12 Jun 2001 06:44:26 -0700

>     followed by an authentication request. However, the inverse SHOULD

$*@&!^@

I think that this sentence needs to be changed:

If both authentication and authorization will be requested for a given session,
the former SHOULD be done prior to the latter. It is still possible for
authorization to be done without authentication.

This covers:
- Authentication first, followed by authorization (such as tacacs+)
- authorize only (may I answer this phone call?)
- authenticate only (well, I have no idea what you'd do this for :(

PatC