Subject: RE: [AAA-WG]: [issue] Clarify relationship between auth and accounting sessions

From: <[email-masked]>
Date: Tue, 4 Jun 2002 10:26:56 +0300

David,

Base-11 says:

	Accounting messages MAY use a different Session-Id from that 
      sent in authorization messages.  Specific applications MAY require 
      different a Session-ID for accounting messages.

> I am aware of the function of the Acct-Multi-Session-Id, and you are correct
> that it binds the sessions of the multi-session together.  What I was trying to
> do was to preserve Diameter's notion of a session and salvage the function of a
> Session-Id, which ought to bind the messages within a session together and ought
> to be useful for purposes such as auditing, independent of application. 
> Session-Id should not work differently for MIP than it does for other Diameter
> applications.  Acct-Multi-Session-Id is not a substitute for Session-Id in MIP. 
> The Acct-Multi-Session-Id AVP is not included in every MIP message.  The
> Session-Id AVP is.
> 
> You are correct that my proposal failed to address the termination of the
> individual authorization sessions.  Unfortunately, MIP, as it is, is simply
> broken.  Not only don't HA sessions correspond to FA sessions.  In mobileip-10,
> they also have no identifier that appears in every message of the session.  And
> there is no mechanism to identify sessions between the HA and the various AAAH's
> that may be involved.  I believe MIP is a faulty extension of Diameter if HA
> sessions cannot be identified using the base protocol.
> 
> Therefore, I'm afraid issue 336 is still unresolved, and now we have a new issue
> regarding the brokeness of HA sessions.  That's more than I want to try to fix
> tonight so, in the words of Scarlett O'Hara, I'll worry about that tomorrow.

MAY is fairly weak, my assumption is that the base-11 is stating that 
session-id's should be the same for accounting & authorization.  What would
you prefer the text to say?  Would:

	Accounting messages SHOULD NOT use a different Session-Id from that 
      sent in authorization messages.  However, specific applications MAY require 
      different a Session-ID for accounting messages.

Is that any better?

John

---

From: Tony Johansson <[email-masked]>
Date: Tue, 04 Jun 2002 09:52:36 -0700

John,

>       different a Session-ID for accounting messages.

I strongly disagree. The text you have in Base is correct and should not be changed..

/Tony