Subject: RE: [AAA-WG]: Diameter Nasreq Draft 15 ready to go to the IESG

From: Avi Lior <[email-masked]>
Date: Mon, 10 May 2004 15:09:10 -0400

Sorry for taking so long to respond. 

> > With respect to when a new session starts.  If we need a guideline 
> > (and it would certainly help) then perhaps we can suggest that any 
> > change is session attribute should be considered a change 
> in session.  
> > Application writers could refine this definition.
> 
> The usage of Service-Type="Authenticate Only" seems to 
> indicate that changes in authentication-related attributes 
> (such as keys or EAP Types) do not constitute a change in 
> authorization.

Yes.

Okay so what happens if its "Authenticate only" and
non-authentication-related attributes are received?  Is the specfication
clear about this (a point I brought up before)

> However, Paul Funk has made an argument that some 
> implementations may use an Accounting START to confirm that 
> the session in fact started
> -- and may assume that it did not start if they don't receive it.

So the call flow is:

Acct Start  Acct-Session Id = X
Interim
Interim
<REAUTHENTICATION>
Acct Start Acct-Session Id = X

> Some questions:
> 
> a. Is it possible to send another Accounting START with the 
> same Session-Id?  Or must the Session-Id always change for each START?

Do you mean Accounting Session-Id or Session-Id?
If you meant Acct-Session Id then it should not change. Because the second
Accounting Start will be detected as a duplicate start record in the
accounting stream. Providing the accounting session id is not modified and
same NAI etc.... Not sure if that is universal but I checked with our folks
and that's what we do.

If you change the Session Id I think you would have to generate an
Accounting Stop to close the old session id.

> b. Is it useful to make a distinction between Service-Type= 
> "Authenticate Only" and other Service-Types?

From a purists point of view Authentication Only should only be about
authentication and not anything do to about authorization.  So I would like
to see that.  But obviously we should not break things.

---

From: Bernard Aboba <[email-masked]>
Date: Mon, 10 May 2004 12:28:40 -0700 (PDT)

> clear about this (a point I brought up before)

RFC 3580 is not clear about this, certainly.  I'm not sure that RFC 2865
is either.  Do you have a proposal?

> Acct Start Acct-Session Id = X

Yes, I think this makes sense.

> same NAI etc.... Not sure if that is universal but I checked with our folks

This makes sense, I think.

Yes.

> to see that.  But obviously we should not break things.

I believe that current usage of "Authenticate Only" is consistent with
that, although usage is not  universal.

---

From: "Mark Peterson" <[email-masked]>
Date: Tue, 11 May 2004 10:21:47 -0500

I no longer want to be this email list, please take me off.

Thank you,

Mark Peterson

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]On Behalf Of
Bernard Aboba
Sent: Monday, May 10, 2004 2:29 PM
To: Avi Lior
Cc: [email-masked]; [email-masked]'
Subject: RE: [AAA-WG]: Diameter Nasreq Draft 15 ready to go to the IESG

Yes.