Subject: [AAA-WG]:

From: "Oscar Morales-Ruiz (ECE)" <[email-masked]>
Date: Mon, 25 Jun 2001 14:55:06 +0200

Hi there,

Maybe this issue was discussed in the past, but I would like to get a clear picture about the Request-Type AVP because I have no clue of the *real* behaviour of this AVP.

The latest draft (06) claims that this AVP is used to determine the type of the request being transmitted. The allowed values are AUTHENTICATE_ONLY, AUTHORIZE_ONLY and AUTHORIZE_AUTHENTICATE. The point is that I was not able to get a clear picture of the possible (and allowed) combinations among those values:

My assumptions are (correct me if I'm wrong):

1. It is possible for a NAS to issue an AUTHENTICATE_ONLY request and later on to issue AUTHORIZE_ONLY requests corresponding to the session previously authenticated. 
   That means that the AAA Server should store information about the session when it is first authenticated and later on to authorize the authorization requests associated to 
   that particular session.

   If subsequent AUTHENTICATE_ONLY messages are received for that particular session, those messages mean re-authentication requests.

   If subsequent AUTHORIZE_ONLY messages are received for that particular session, those messages mean re-authorization requests (and possibly authorization requests for 
   those services not previously authorized).

   If subsequent AUTHORIZE_AUTHENTICATE messages are received for that particular session, those messages mean re-authentication plus re-authorization requests (and 
   possibly new authorization requests for those services not previoulsy authorized).

2. It is possible to AUTHORIZE_AUTHENTICATE a session which means that the session is first authenticated and then the access to a particular service is authorised. 

   Hence it is possible to receive AUTHENTICATE_ONLY messages which mean re-authentication for the existing session. It is also possible to receive AUTHORIZE_ONLY 
   messages for that existing session which mean authorization requests for the existing session (and maybe re-authorization for those services previously authorized).

   If subsequent AUTHORIZE_AUTHENTICATE messages are received for that particular session, those messages mean re-authentication plus re-authorization requests.

3. Is it possible to receive an AUTHORIZE_ONLY message without a previous authentication request ?? I should say yes, but it is not clear to me :-(( 

   I would like to get a clarification on this one.

Cheers,
Oscar.