Subject: Re: [AAA-WG]: Authorization-Lifetime/Session-Timeout confusion

From: David Mitton <[email-masked]>
Date: Mon, 01 Sep 2003 13:20:39 -0400

I like this suggestion.
Bernard had complained about a similar issue in #404 wrt to 802.1x, but I 
had problems working out all the details.

If there are no further comments, I'll incorporate this approach in NASREQ 
making sure it works with IEEE 802.1x or 802.1aa or whatever it is this week.

Dave.

On 8/15/2003 04:13 PM +0300, [email-masked] wrote:

>Submitter name: Pasi Eronen
>Submitter email address: [email-masked]
>Date first submitted: August 15, 2003
>Reference:
>Document: NASREQ
>Comment type: T
>Priority: 1
>Section: various
>Rationale/Explanation of issue:
>
>There seems to be some confusion about Authorization-Lifetime
>and Session-Timeout AVPs between Base and NASREQ.
>
>More specifically, the state machine in Base (Section 8.1)
>specifies that when Session-Timeout expires, the access
>device MUST send a STR and move to state Discon.
>
>This is inconsistent with with NASREQ description for
>Termination-Action AVP, which allows other behavior as well.
>
>Proposed change:
>
>Remove the Termination-Action AVP completely.
>
>When translating a RADIUS Access-Accept to Diameter AA-Answer,
>do the following:
>
>- If the RADIUS message contains a Session-Timeout attribute
>   and a Termination-Action attribute set to DEFAULT (or no
>   Termination-Action attribute at all), translate it
>   to AA-Answer with a Session-Timeout AVP (and remove
>   the Termination-Action attribute).
>
>- If the RADIUS message contains a Session-Timeout attribute
>   and a Termination-Action attribute set to AA-REQUEST,
>   translate it to AA-Answer with Authorization-Lifetime AVP
>   and Re-Auth-Request-Type set to AUTHORIZE_AUTHENTICATE
>   (and remove the Session-Timeout attribute).
>
>When translating a Diameter AA-Answer (with successful result
>code) to RADIUS Access-Accept,
>
>- If the Diameter message contains a Session-Timeout AVP but no
>   Authorization-Lifetime AVP, translate it to Session-Timeout
>   attribute (and no Termination-Action).
>
>- If the Diameter message contains a Authorization-Lifetime AVP but
>   no Session-Timeout AVP, translate it to Session-Timeout attribute
>   and Termination-Action set to AA-REQUEST. (And remove
>   Authorization-Lifetime and Re-Auth-Request-Type)
>
>- If the Diameter message has both, the Session-Timeout is always
>   greater or equal than Authorization-Lifetime (required by Base).
>   I guess the safest bet is to translate it to Session-Timeout
>   value (with value from Authorization-Lifetime AVP, the smaller one)
>   and Termination-Action set to AA-REQUEST. (And remove
>   Authorization-Lifetime and Re-Auth-Request-Type)
>
>Best regards,
>Pasi