Subject: [AAA-WG]: Proposed text for Issue 82

From: Pat Calhoun <[email-masked]>
Date: Thu, 12 Jul 2001 10:42:33 -0700

All,

Below is some proposed text to solve Issue 82. I would welcome comments.

PatC
----

8.9  Authorization-Lifetime AVP

   The Authorization-Lifetime AVP (AVP Code 291) is of type Unsigned32
   and contains the maximum number of seconds of service to be provided
   to the user before the user is to be re-authenticated and/or re-
   authorized. Great care should be taken when the Authorization-
   Lifetime value is determined, since a low, non-zero, value could
   create significant Diameter traffic, which could congest both the
   network and the agents.

   A value of zero (0) means that immediate re-auth is necessary by the
   access device. This is typically used in cases where multiple
   authentication methods are used, and a successful auth response with
   this AVP set to one is used to signal that the next authentication
   method is to be immediately initiated.  The absence of this AVP, or a
   value of all ones (-1) means no re-auth is expected.

   If both this AVP and the Session-Timeout AVP are present in a
   message, the value of the latter MUST NOT be smaller than the
   Authorization-Lifetime AVP.

   An Authorization-Lifetime AVP MAY be present in a re-authorization
   messages, and contains the number of seconds the user is authorized
   to receive service from the time the re-auth answer message is
   received by the access device.

   This AVP MAY be provided by the client as a hint of the maximum
   lifetime that it is willing to accept. However, the server MAY return
   a value that is equal to, or smaller, than the one provided by the
   client.

8.X  Auth-Grace-Period AVP

   The Auth-Grace-Period AVP (AVP Code TBD) is of type Unsigned32 and
   contains the number of seconds the Diameter server will wait
   following the expiration of the Authorization-Lifetime AVP before
   cleaning up resources for the session.

   This AVP MAY be provided by the client as a hint of the maximum
   lifetime that it is willing to accept. However, the server MAY return
   a value that is equal to, or smaller, than the one provided by the
   client.

Calhoun et al.            expires December 2001                [Page 89]

Internet-Draft                                                 June 2001

8.X  Auth-Session-State AVP

   The Auth-Session-State AVP (AVP Code TBD) is of type Enumerated
   and    specifies whether state is maintained for a particular
   session. The client MAY include this AVP in requests as a hint to the
   server. The following values are supported:

      STATE_MAINTAINED              0
         This value is used to specify that session state is being
         maintained, and the access device MUST issue a session
         termination message when service to the user is terminated.
         This is the default value.

      NO_STATE_MAINTAINED           1
         This value is used to specify that no session termination
         messages will be sent by the access device upon expiration of
         the Authorization-Lifetime.

8.X  Re-Auth-Request-Type AVP

   The Re-Auth-Request-Type AVP (AVP Code TBD) is of type Enumerated and
   is included in application-specific auth answers to inform the client
   of the action expection upon expiration of the Authorization-
   Lifetime.  The following values are defined:

      AUTHORIZE_ONLY             0
         An authorization only re-auth is expected upon expiration of
         the Authorization-Lifetime.    This is the default value if the
         AVP is not present in answer messages that include the
         Authorization-Lifetime.

      AUTHORIZE_AUTHENTICATE     1
         An authentication and authorization re-auth is expected upon
         expiration of the Authorization-Lifetime.

8.10  Session-Timeout AVP

   The Session-Timeout AVP (AVP Code 27) [1] is of type Unsigned32 and
   contains the maximum number of seconds of service to be provided to
   the user before termination of the session. When both the Session-
   Timeout and the Authorization-Lifetime AVPs are present in an answer
   message, the former MUST be equal to or greater than the value of the
   latter.

   A session that terminates on an access device due to the expiration
   of the Session-Timeout MUST cause an STR to be issued, unless both

Calhoun et al.            expires December 2001                [Page 90]

Internet-Draft                                                 June 2001

   the access device and the home server had previously agreed that no
   session termination messages would be sent (see section 8.9).

   A Session-Timeout AVP MAY be present in a re-authorization messages,
   and contains the number of seconds from the beginning of the re-auth.

   A value of zero, or the absence of this AVP, means that this session
   has an unlimited number of seconds before termination.

   This AVP MAY be provided by the client as a hint of the maximum
   timeout that it is willing to accept. However, the server MAY return
   a value that is equal to, or smaller, than the one provided by the
   client.