Subject: [AAA-WG]: Issue 42: Session-Timeout inconsistent with RADIUS spec

From: Pat Calhoun <[email-masked]>
Date: Tue, 12 Jun 2001 09:11:29 -0700

All,

The inconsistency identified was that RADIUS re-uses the Session-Timeout attribute
in Access-Challenge messages to inform the access device how long it should wait for
the user's response. In order to fix this issue, I propose adding the following text to
the base protocol specification:

10.14  Multi-Round-Time-Out AVP

   The Multi-Round-Time-Out AVP (AVP Code TBD) is of type Unsigned32,
   and SHOULD be present in application-specific authorization answer
   messages whose Result-Code AVP is set to DIAMETER_MULTI_ROUND_AUTH.
   This AVP contains the maximum number of seconds that the access
   device MUST provide the user in responding to an authentication
   request.

And the following text to the protocol conversion section (9.x) in the NASREQ
application specification.

9.1  RADIUS request forwarded as Diameter request

   [...]
      - If the Diameter Command-Code is set to AA-Answer and the
        Result-Code AVP is set to DIAMETER_MULTI_ROUND_AUTH, the gateway
        must send a RADIUS Access-Challenge with the the Diameter
        Session-Id and the Origin-Host AVPs are saved in the RADIUS
        State attribute, with the prefix "Diameter/". This is necessary
        in order to ensure that the protocol gateway that will receive
        the subsequent RADIUS Access-Request will have access to the
        Session Identifier, and be able to set the Destination-Host to
        the correct value. If the Multi-Round-Time-Out AVP is present,
        the value of the AVP MUST be inserted in the RADIUS Session-
        Timeout AVP.
[editor's note, new last sentence]

9.2  Diameter request forwarded as RADIUS request

   [...]
      - If the RADIUS code is set to Access-Challenge, a Diameter AA-
        Answer message is created with the Result-Code set to
        DIAMETER_MULTI_ROUND_AUTH. If the Session-Timeout AVP is present
        in the RADIUS message, its value is inserted in the Multi-
        Round-Time-Out AVP.
[editor's note, new last sentence]

Comments appreciated,

PatC

---

From: David Spence <[email-masked]>
Date: Wed, 13 Jun 2001 16:55:36 -0400

See editorial corrections below.

>         must send a RADIUS Access-Challenge with the the Diameter
                                                       xxxx

>         Session-Id and the Origin-Host AVPs are saved in the RADIUS
                                              xxxx

> [editor's note, new last sentence]
  [reviewer's note, bad first sentence ;) ]

-- 
David Spence                            email: [email-masked]
Interlink Networks, Inc.                phone: (734) 821-1203
775 Technology Drive, Suite 200         fax:   (734) 821-1235
Ann Arbor, MI 48108           
U.S.A.