Subject: [AAA-WG]: [Issue] Diameter/DynAuth RADIUS translation

From: Bernard Aboba <[email-masked]>
Date: Mon, 1 Sep 2003 11:11:11 -0700 (PDT)

Submitter name: Bernard Aboba
Submitter email address: [email-masked]
Date first submitted: September 1, 2003
Reference:
Document: nasreq-12
Comment type: T
Priority: S
Section: Various
Rationale/Explanation of issue:

Update the references:

[RADDynAuth]  M. Chiba, M Dommety, M. Eklund, D. Mitton, B. Aboba,
              "Dynamic Authorization Extensions to Remote
              Authentication Dial In User Service (RADIUS)",
              RFC 3576, August 2003.

[RADIUSIANA]  B. Aboba, "IANA Considerations for RADIUS", RFC 3575,
              August 2003.

[RAD802.1X]   P. Congdon, et.al "IEEE 802.1X RADIUS Usage Guidelines",
              RFC 3580, September 2003.

Update Section 6.1 to include the new Service-Type value:

    17  Authorize Only  [RFC3576]

Delete the following text from Section 9.1:

"   If the Diameter translation system receives a message as specified in
   [RADDynAuth], it may translate it into a Diameter Re-Auth-Request
   message.  The consistency and security rules of that specification
   MUST be applied to the processing and forwarding of this type of
   message."

Add the following to Section 9.1:

As described in Section 3.2 of [RADDynAuth], a Service-Type of "Authorize
Only" is used in a Disconnect-Request or CoA-Request message, in order to
allow for easier translation between RADIUS and Diameter.  In order to
simplify implementation, a RADIUS/Diameter gateway receiving a RADIUS
Disconnect-Request without a Service-Type value of "Authorize Only"
MAY reply with a Disconnect-Nak with an Error-Cause attribute with
value 405," Unsupported Service" and no Service-Type attribute.

Similarly, a RADIUS/Diameter gateway
receiving a RADIUS CoA-Request without a Service-Type value of
"Authorize Only" MAY reply with a CoA-Nak with an Error-Cause
attribute with value 405, "Unsupported Service" and no Service-Type
attribute.

When included within a RADIUS Disconnect-Request or CoA-Request, a
Service-Type Attribute with value "Authorize Only" indicates that the
Request only contains NAS and session identification attributes.

A RADIUS CoA-Request is translated to a Diameter Re-Authorization
Request (RAR), and a RADIUS Disconnect-Request is translated to a Diameter
Session-Termination-Request (STR).

A Diameter Re-Authorization Request (RAR) message will receive a
Diameter Re-Authorization Answer (RAA) reply which is translated to a
RADIUS CoA-NAK containing a Service-Type Attribute with value "Authorize Only"
and an Error-Cause Attribute with value "Request Initiated."

A Diameter Session-Termination-Request (STR) message will receive a
Diameter Session-Termination-Answer (STA) message reply which is tranlated
to a RADIUS Disconnect-Nak containing a Service-Type Attribute with value
"Authorize Only" and an Error-Cause Attribute with value "Request
Initiated."

After a Diameter Re-Authorization Answer (RAA) is sent, a
Diameter AA-Request will then be sent and is translated to
a RADIUS Access-Request with a Service-Type attribute with value "Authorize Only",
attempting reauthorization.  This Access-Request contains the NAS
attributes from the CoA-Request, as well as the session
attributes from the Request legal for inclusion in an Access-Request.
The RADIUS server will send back an Access-Accept to (re-)authorize
the session or an Access-Reject to refuse to (re-)authorize it. This is
translated to a Diameter AA-Answer.

After a Diameter Session-Termination-Answer (STA) is sent, a
Diameter Abort-Session-Request (ASR) will be sent and is translated to a
RADIUS Access-Request with a Service-Type  attribute with value "Authorize
Only", attempting reauthorization.  This Access-Request contains the NAS
and session attributes from the Disconnect-Rquest.  The RADIUS server
send back an Access-Reject to terminate the session. This is translated to
a Diameter Abort-Session-Answer (ASA)."

Add the following to Section 9.2:

"A Diameter Re-Authorization-Request (RAR) message may be translated to a
RADIUS CoA-Request with a Service-Type of "Authorization Only".  If a
RADIUS CoA-NAK containing a Service-Type Attribute with value "Authorize Only"
and an Error-Cause Attribute with value "Request Initiated" is received in
reply, this is translated to a Diameter Re-Authorization-Answer (RAA).

An ensuing RADIUS Access-Request with Service-Type of "Authorize Only" is
translated to a Diameter AA-Request, and the Diameter AA-Answer is
translated to a RADIUS Access-Accept or Access-Reject.

A Diameter Session-Termination-Request (STR) is translated to a
RADIUS Disconnect-Rquest with a Service-Type of "Authorization Only". If a
RADIUS Disconnect-NAK containing a Service-Type Attribute with value
"Authorize Only" and an Error-Cause Attribute with value "Request
Initiated" is received in reply, this is translated to a Diameter
Session-Termination-Answer (STA).

An ensuing RADIUS Access-Request with Service-Type of "Authorize Only" is
translated to a Diameter Abort-Session-Request, and the Diameter
Abort-Session-Answer is translated to a RADIUS Access-Reject."

---

From: Jari Arkko <[email-masked]>
Date: Tue, 02 Sep 2003 17:32:28 +0300

> Rationale/Explanation of issue:

Ok.

>     17  Authorize Only  [RFC3576]

Ok.

> Add the following to Section 9.1:
...
> Add the following to Section 9.2:

The text sounds right. But I wonder if my head hurts because
I'm tired, or because a sequence diagram would make the issue
easier. The particular piece of text I had trouble with was
where STA, ASR, and RADIUS Access Request were mentioned in
the same sentence. Which direction are these messages sent?

--Jari

---

From: Bernard Aboba <[email-masked]>
Date: Thu, 4 Sep 2003 13:32:39 -0700 (PDT)

> the same sentence. Which direction are these messages sent?

I got a bit lazy and didn't include as much detail in Section 9.2 as in
Section 9.1.  I'll rework it.

---

From: Bernard Aboba <[email-masked]>
Date: Thu, 11 Sep 2003 18:40:36 -0700 (PDT)

> the same sentence. Which direction are these messages sent?

How does this look?

Section 9.2

"If the Diameter/RADIUS gateway supports [RADDynAuth], it may translate
a Diameter Re-Authorization-Request (RAR) message to a RADIUS CoA-Request
with a Service-Type value of "Authorization Only".  It is possible that
the NAS receiving this message will not support [RADDynAuth], in which
case an ICMP Port Unreachable message will be returned to the
Diameter/RADIUS gateway.  However, even if the NAS supports [RADDynAuth],
it may not support a Service-Type value of "Authorization Only" in a
CoA-Request message.  In this case it will respond with a CoA-Nak and
(optionally) an Error-Cause attribute with value 405," Unsupported
Service" and no Service-Type attribute.  If a Diameter/RADIUS gateway
receives such a packet, or an ICMP port unreachable message, or if it does
not support [RADDynAuth], then it SHOULD reply to the AAA server with a
Diameter Re-Authorization-Answer (RAA) message with a
Result-Code AVP of "DIAMETER_COMMAND_UNSUPPORTED".

If in response to a CoA-Request sent to the NAS, the Diameter/RADIUS
gateway  receives a RADIUS CoA-NAK containing a
Service-Type Attribute with value "Authorize Only"
and an Error-Cause Attribute with value "Request Initiated",
this is translated to a Diameter Re-Authorization-Answer (RAA)
with a Result-Code AVP of "DIAMETER_LIMITED_SUCCESS" sent to the
AAA server.

Subsequently, the Diameter/RADIUS gateway should receive a RADIUS
Access-Request from the NAS, with a Service-Type of "Authorize Only".
This is translated to a Diameter AA-Request with an Auth-Request-Type AVP
of AUTHORIZE_ONLY, sent to the AAA server.  The AAA server will then reply
with a Diameter AA-Answer, which is translated to a RADIUS Access-Accept
or Access-Reject, depending on the value of the Result-Code AVP.

A Diameter/RADIUS gateway supporting [RADDynAuth] may translate
a Diameter Session-Termination-Request (STR) message received from the
AAA server to a RADIUS Disconnect-Request with a Service-Type value of
"Authorization Only", sent to the NAS.

It is possible that the NAS receiving this message will not support
[RADDynAuth], in which case an ICMP Port Unreachable message will be
returned to the Diameter/RADIUS gateway.  Even if the NAS supports [RADDynAuth],
it may not support a Service-Type value of "Authorization Only" in a
Disconnect-Request message.  In this case it will respond with a CoA-Nak
and (optionally) an Error-Cause attribute with value 405," Unsupported
Service" and no Service-Type attribute.  If the Diameter/RADIUS gateway
encounters these error conditions, or if it does not support [RADDynAuth],
it sends a Diameter Re-Authorization-Answer (RAA) message with an
Result-Code AVP of "DIAMETER_COMMAND_UNSUPPORTED" to the AAA server.

If the NAS does support [RADDynAuth] and a Disconnect-Request message with
a Service-Type value of "Authorize Only" it will typically reply with a
RADIUS Disconnect-NAK containing a Service-Type Attribute with value
"Authorize Only" and an Error-Cause Attribute with value "Request
Initiated".  A Diameter/RADIUS gateway supporting [RADDynAuth] translates this to a
Diameter Session-Termination-Answer (STA) with a Result-Code AVP of
"DIAMETER_LIMITED_SUCCESS", sent to the AAA Server.

Subsequently, the Diameter/RADIUS gateway should receive a RADIUS
Access-Request from the NAS, with a Service-Type of "Authorize Only".
This is translated to a Diameter Abort-Session-Request (ASR), sent to the
AAA server. The AAA server will then reply with a Diameter Abort-Session-Answer (ASA),
which the Diameter/RADIUS gateway translates to a RADIUS Access-Reject
sent to the NAS."