Subject: RE: [AAA-WG]: Issue 77: Possibility for implicit termination of an Authentication or Authorization session.

From: [email-masked]
Date: Wed, 13 Jun 2001 11:28:52 +0300

Hi,

I also find this useful. A clarifying question still, is this only
applicable for the case where the access device has set the
Authorization-Lifetime to zero in the first authentication/authorization
request or is it possible for a server to implicitely terminate any ongoing
session by setting the Authorization-Lifetime to zero even without any hint
from the access device? I assume that it is the first case. Correct?

Br, Jaakko 

> -----Original Message-----
> From: ext Pat Calhoun [mailto:[email-masked]]
> Sent: 12 June, 2001 3:48
> To: Tony Johansson
> Cc: [email-masked]
> Subject: Re: [AAA-WG]: Issue 77: Possibility for implicit 
> termination of
> an Authentication or Authorization session.
> 
> 
> Tony,
> 
> This works for me, and including a zero 
> Authorization-Lifetime is a great way
> for an access device to signal that it doesn't expect to send 
> additional messages to
> the home server. Of course, I *think* that some issues MAY 
> arise if the home server
> decides that it wishes to maintain state, so a Result-Code 
> value must also be 
> created to allow the server to reject specifically this 
> request (as opposed to some
> complicated Failed-AVP processing.
> 
> Anyone object to this reasonable request? I can think of 
> quite a few uses.
> 
> PatC
> On Mon, Jun 11, 2001 at 04:45:12PM -0700, Tony Johansson wrote:
> > All,
> > 
> > Here is a new issue.
> > 
> > /Tony
> > 
> > Issue 77:  Possibility for implicit termination of an 
> Authentication or
> > Authorization session.
> > Submitter name: Tony Johansson
> > Submitter email address: [email-masked]
> > Date first submitted: 2001-06-11
> > Reference:
> > Document: Base
> > Comment type: T
> > Priority: 1
> > Section: 10
> > Rationale/Explanation of issue:
> > There may be cases where you don't need to store any 
> session information
> > in the AAA. For example, there may be cases where the 
> access device will
> > handle all seesion information. Thus, an access device may request
> > authentication as a one time thing and no further messages would be
> > needed between the access device and the AAA.
> > 
> > Proposal:
> > Perhaps a request from the access device SHOULD allow the
> > Authorization-Lifetime (as a hint to the server). A value of zero
> > implies that no state should be created, and no STR will be sent. A
> > value of zero is a one-shot thing (auth once, never hear 
> from me again).
> > 
>

---

From: Pat Calhoun <[email-masked]>
Date: Wed, 13 Jun 2001 06:51:57 -0700

> from the access device? I assume that it is the first case. Correct?

Correct, and of course, the text would have the explicitely state this.

Thanks for pointing this out,

PatC