Subject: [AAA-WG]: (draft-mobileip-08) Session-Binding & Re-Auth-Request-Type clarifications

From: "Bob Kopacz" <[email-masked]>
Date: Mon, 25 Feb 2002 13:11:02 -0500

A couple clarifications.  My real concern is interoperability: that the
mobility agents know what to expect from the AAA servers.

Session-Binding AVP
--------------------

Section 1.2. of draft-mobileip-08 says:

>  1.2 Inter-Realm Mobile IP
>  
>  [...]
>  
>  In the event that the AMR generated by the FA is for a session that
>  has was previously authorized by the AAAH, it MUST include the
>  Destination-Host AVP, with the identity of the AAAH. 

(1) Question: Does this mean the AAAH, when sending back an AMA,
should include a Session-Binding AVP with the RE-AUTH flag OFF?

Recall that the Base drafts says that "The Session-Binding AVP MAY be
present in application-specific authorization answer messages. If
present, this AVP MAY inform the Diameter client that all future
application-specific re-auth messages for this session MUST be sent to
the same authorization server."

So the Session-Binding AVP can be used to specify the exact behavior
that draft-mobileip-08 wants from the FA.  

Or, putting the question another way, since this is the required
behavior of the FA, is it necessary for the AAAH to send the
Session-Binding AVP?

(2) The Session-Binding AVP is not mentioned at all in
draft-mobileip-08; not in the AMR/AMA/HAR/HAA occurrence rule table,
not in the message ABNF, not in the text.

So maybe add an occurrence rule entry like:

   Attribute Name                | AMR | AMA | HAR | HAA |
   ------------------------------|-----+-----+-----+-----+
   Session-Binding               | 0   | 0-1 | 0   | 0   |

..............................................................

Re-Auth-Request-Type AVP
------------------------

(3) Question: Should the AAAH, when sending back an AMA which includes
a positive Authorization-Lifetime, also send a Re-Auth-Request-Type
AVP with the value AUTHORIZE_AUTHENTICATE (to let the FA know the
re-auth requirements)?

This seems so, since the occurrence rules indicate the
Re-Auth-Request-Type can be present 0-1 times in an AMA.

---

From: Tony Johansson <[email-masked]>
Date: Tue, 26 Feb 2002 19:23:58 -0800

Hi Bob,

Can you please send an issue on what you believe should be clarified in the
spec. It is really hard for me to keep track of all possible changes
otherwise.

Regards,

/Tony