Subject: RE: [AAA-WG]: Fwd: I-D ACTION:draft-ietf-aaa-eap-06.txt

From: <[email-masked]>
Date: Mon, 14 Jun 2004 18:03:37 +0300

Hi,

Seems logical enough. Would the following text be sufficient?

  When the NASREQ AA-Request (AAR) or AA-Answer (AAA) commands
  are used for authorization in conjunction with EAP (see
  Section 2.3.3), the Auth-Application-Id AVP MUST be set to 1
  (NASREQ), and the rules and command ABNF defined in [NASREQ]
  MUST be followed.

  Similarly, when the Re-Auth-Request (RAR), Re-Auth-Answer
  (RAA), Session-Termination-Request (STR),
  Session-Termination-Answer (STA), Abort-Session-Request (ASR),
  Abort-Session-Answer (ASA), Accounting-Request (ACR), and
  Accounting-Answer (ACA) commands are used together with the
  Diameter EAP application, they follow the rules in [NASREQ]
  and use Auth-Application-Id 1.

Best regards,
Pasi

> -----Original Message-----
> From: ext Bernard Aboba [mailto:[email-masked]]
> Sent: Monday, June 14, 2004 5:42 PM
> To: Eronen Pasi (Nokia-NRC/Helsinki)
> Cc: [email-masked]; [email-masked]
> Subject: RE: [AAA-WG]: Fwd: I-D ACTION:draft-ietf-aaa-eap-06.txt
> 
> 
> My understanding of RFC 3588 is that if you only add 
> *optional* AVPs, then
> the Application-ID does not change.  So if the NASREQ ABNF is 
> valid for a command, then you can (and should) use an 
> Application-Id of NASREQ.
> 
> Note that an EAP AVP cannot be optional, so commands using EAP
> payloads need the Diameter EAP Application ID.  However, 
> commands that do not use EAP payloads do not need (and in my 
> opinion should not use) the EAP Application-ID.
> 
> I think this approach makes sense because it follows the "Principle of
> Least Astonishment" -- if the usage is indistinguishable from
> NASREQ, why should the application-ID change?
> 
> On Mon, 14 Jun 2004 [email-masked] wrote:
> 
> > Hi,
> >
> > Would it simplify things if the messages copied straight
> > from NASREQ (RAR/RAA, STR/STA, ASR/ASA and also ACR/ACA)
> > would use Auth-Application-Id 1 (NASREQ) instead?
> >
> > (This way e.g. a translation agent would not need to keep
> > track of whether a PPP session was originally authenticated
> > with CHAP or EAP... but then again, I have not considered
> > this case thoroughly.)
> >
> > I'm also wondering whether copying the ABNF for ACR/ACA
> > is necessary... (presumably, some later document that e.g.
> > defines a new WLAN-specific AVP/attribute would not copy
> > the whole ABNF of all messages; just saying in which messages
> > the AVP can be included would be enough.)
> >
> > Best regards,
> > Pasi
>

---

From: Bernard Aboba <[email-masked]>
Date: Mon, 14 Jun 2004 08:18:59 -0700 (PDT)

I think this makes sense.  You might make the first paragraph more clear
by saying "are used for AUTHORIZATION_ONLY messages in conjunction with
EAP (see Section 2.3.3),".

---

From: Jari Arkko <[email-masked]>
Date: Mon, 14 Jun 2004 22:22:19 +0300

This text is fine, thanks.

--Jari

---

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 14 Jun 2004 16:10:08 -0700

Maybe this was discussed in the past but why can't we use application
id for the base protocol (=0) for RAR, RAA, STR, STA, ASR, ASA, ACR
and ACA commands instead of NASREQ's application id?  All those
commands that are re-defined in the NASREQ draft have no new required
AVPs specific to NASREQ.  So it does not make sense to me to use
NASREQ application id for those messages.

Yoshihiro Ohba

---

From: Bernard Aboba <[email-masked]>
Date: Mon, 14 Jun 2004 17:53:39 -0700 (PDT)

Good point, Yoshi.

With respect to RAR/RAA, STR/STA, ASR/ASA and ACR/ACA you are correct that
NASREQ defines no new mandatory AVPs, and neither does EAP.  So according to the RFC 3588
Appliation ID guidelines it would indeed seem correct to just use the Base
Application-ID.  As I understand it, MIPv4 does not use RAR/RAA, and does
not define any new mandatory AVPs in STR/STA, ASR/ASA or ACR/ACA.  So it
would seem that MIPv4 should also use the Base Application-ID for those
commands.

---

From: Yoshihiro Ohba <[email-masked]>
Date: Tue, 15 Jun 2004 05:23:32 -0700

> would seem that MIPv4 should also use the Base Application-ID for those

Looks good.

BTW, I have a correction to my previous comment:

For ACR/ACA, application id for Diameter Base Accounting (=3) should
be used, while application id for Diameter Common Messages (=0) should
be used for RAR/RAA, STR/STA and ASR/ASA.

Yoshihiro Ohba