Subject: [AAA-WG]: Authorization-Lifetime/Session-Timeout confusion

From: <[email-masked]>
Date: Fri, 15 Aug 2003 16:13:13 +0300

Submitter name: Pasi Eronen
Submitter email address: [email-masked]
Date first submitted: August 15, 2003
Reference: 
Document: NASREQ
Comment type: T
Priority: 1
Section: various
Rationale/Explanation of issue:

There seems to be some confusion about Authorization-Lifetime
and Session-Timeout AVPs between Base and NASREQ.

More specifically, the state machine in Base (Section 8.1) 
specifies that when Session-Timeout expires, the access 
device MUST send a STR and move to state Discon. 

This is inconsistent with with NASREQ description for
Termination-Action AVP, which allows other behavior as well.

Proposed change:

Remove the Termination-Action AVP completely. 

When translating a RADIUS Access-Accept to Diameter AA-Answer, 
do the following:

- If the RADIUS message contains a Session-Timeout attribute
  and a Termination-Action attribute set to DEFAULT (or no 
  Termination-Action attribute at all), translate it 
  to AA-Answer with a Session-Timeout AVP (and remove
  the Termination-Action attribute).

- If the RADIUS message contains a Session-Timeout attribute
  and a Termination-Action attribute set to AA-REQUEST,
  translate it to AA-Answer with Authorization-Lifetime AVP
  and Re-Auth-Request-Type set to AUTHORIZE_AUTHENTICATE
  (and remove the Session-Timeout attribute).

When translating a Diameter AA-Answer (with successful result
code) to RADIUS Access-Accept,

- If the Diameter message contains a Session-Timeout AVP but no 
  Authorization-Lifetime AVP, translate it to Session-Timeout 
  attribute (and no Termination-Action).

- If the Diameter message contains a Authorization-Lifetime AVP but 
  no Session-Timeout AVP, translate it to Session-Timeout attribute 
  and Termination-Action set to AA-REQUEST. (And remove
  Authorization-Lifetime and Re-Auth-Request-Type)

- If the Diameter message has both, the Session-Timeout is always
  greater or equal than Authorization-Lifetime (required by Base). 
  I guess the safest bet is to translate it to Session-Timeout
  value (with value from Authorization-Lifetime AVP, the smaller one) 
  and Termination-Action set to AA-REQUEST. (And remove 
  Authorization-Lifetime and Re-Auth-Request-Type)

Best regards,
Pasi