Subject: [AAA-WG]: Issue : Remove section 1.6 from the CMS appl

From: Tony Johansson <[email-masked]>
Date: Thu, 07 Feb 2002 16:20:09 -0800

Issue : Remove section 1.6 from the CMS appl
Submitter name: Tony
Submitter email address: [email-masked]
Date first submitted: 02-07-2002
Reference:
Document: cms-03
Comment type: Technical/Editorial
Priority: 1
Section: 1.6
Rationale/Explanation of issue:

In the discussion and proposed solution to issue #266 - Returning
AAAF-Generated FA-HA Key to FA (please find detailed background info in
http://www.merit.edu/mail.archives/aaa-wg/msg02986.html message thread)
we have identified the need to be able to issue DSA messages between two
AAA(F) servers, where none of the nodes belong to the same realm as the
user being authorized.

This seems to be okay and straight forward according to the CMS
application except for what is stated in section 1.6.

“However, it is important to note that one of participants of a DSA
(specifically the one in the home network) MUST belong to the same realm
as the user being authorized (the realm portion of the Network Access
Identifier found in the User-Name AVP), otherwise an answer is returned
with the Result-Code AVP set to DIAMETER_AUTHORIZATION_REJECTED.”

The CMS application describes how a security association is established
by two peers through agents, and how authentication, integrity,
confidentiality and non-repudiation (with proof of origin) are achieved
using a mixture of symmetric and asymmetric transforms, by encapsulating
CMS data within AVPs. Thus, the nature of this application deals with
servers and not users. Do really have to bring in user authorization as
described in section 1.6?

Requested change:

Remove section 1.6, so that the CMS application only talks about
security association establishment between peers, encryption of AVPs
between peers, etc.