Subject: RE: [AAA-WG]: [issue] AAA URI is Overloaded

From: <[email-masked]>
Date: Wed, 27 Feb 2002 21:44:55 +0200

Hi Don,

> I am not in favor of advertising a DiameterIdentity over a 
> connection if the
> DiameterIdentity does not reflect settings actually used on 
> the connection.
> 
> I think the DiameterIdentity used to be an FQDN.  There was 
> concern that
> multiple Diameter nodes on a host could not be uniquely 
> identified, so the
> DiameterIdentity changed to be FQDN plus port plus protocol.  
> More recently,
> transport security was added to the DiameterIdentity.
> 
> I'd like to consider changing DiameterIdentity back to being an FQDN.
> 
> Proposed Text:
> 
> A Diameter node must be uniquely identified by its 
> DiameterIdentity, which is an
> FQDN.  If multiple Diameter nodes run on the same host, each 
> Diameter node
> MUST be assigned a unique DiameterIdentity.
> 
> End Proposed Text
> 

What I have added is the following:

DiameterIdentity

  The DiameterIdentity format is derived from the OctetString AVP Base Format.  
  It uses the UTF-8 encoding and has the same requirements as the UTF8String.  
  In addition, it must follow the Uniform Resource Identifiers (URI) syntax 
  [URI] rules specified below:

	DiameterIdentity  = fqdn

  A Diameter node must be uniquely identified by its DiameterIdentity, which 
  is an FQDN.  If multiple Diameter nodes run on the same host, each Diameter 
  node MUST be assigned a unique DiameterIdentity.

Does this work?

John

---

From: Don Zick <[email-masked]>
Date: Wed, 27 Feb 2002 14:48:35 -0500

Hi John,

Yes, sounds perfect to me!

Thanks,
Don

---

From: David Spence <[email-masked]>
Date: Wed, 27 Feb 2002 16:59:01 -0500

One question: Does it make any difference whether there is an A record for
the fqdn in the DNS, i.e., does the fqdn actually need to be registered?  I
think not.  And if it doesn't, that makes it easier for administrators. 
Suppose I run two Diameter servers on srv.interlinknetworks.com.  Then I
could configure one to call itself diam1.srv.interlinknetworks.com, and I
could configue the other to call itself diam2.srv.interlinknetworks.com. 
Voila!  I have guaranteed uniqueness without having to register a domain
name.  If this is agreeable, it might be worth stating in the draft that the
term fqdn does not imply that the name be registered, only that it be
unique.

---

From: Jacques Caron <[email-masked]>
Date: Wed, 27 Feb 2002 23:19:07 +0100

Even though the full name need not necessarily be in the DNS (though this 
might have other consequences?), it is necessary that it is based on a 
domain name that is registered and owned by the administrator of the 
server. Otherwise we'll end up with a bunch of "diameter.example.com" all 
over which are definitely not unique :-(

I think it's easier if the fqdn is really registered, just for the purposes 
of ensuring uniqueness.

Jacques.

>term fqdn does not imply that the name be registered, only that it be

_________________________________________________________
Do You Yahoo!?
Get your free @yahoo.com address at http://mail.yahoo.com

---

From: David Spence <[email-masked]>
Date: Wed, 27 Feb 2002 19:12:52 -0500

Actually, my idea was that the portion of the identity string following the
first dot would be a real host name registered to the host on which the
server was running.  In my example below, both servers were running on
srv.interlinknetworks.com, which is the real name of the host.  diam1 and
diam2 would be unregistered prefixes to a registered host name.

---

From: Jacques Caron <[email-masked]>
Date: Thu, 28 Feb 2002 01:55:37 +0100

Then you're really adding something to the "real" FQDN that is functionally 
equivalent to a port number :-)

If you manage to write some text that explains that clearly and 
unambiguously, why not. But I think it's easier to stick to "real" FQDNs. 
It's never hurt anyone to register a couple of addresses in the DNS.

As an alternative, if the Identity is considered fully opaque, nothing 
prevents us to change it to FQDN;<anything-unique to the host>. Where 
<anything unique to the host> may be a PID, a port number, a configuration 
file path name, or any other arbitrary string.

Jacques.