Subject: [Dime] Question on Auth-Application-Id AVP in Diameter answer messages

From: "Gowda, Avinash" <[email-masked]>
Date: Thu, 26 Feb 2009 12:23:45 +0530

Hi All,

I have question on mandating Auth-Application-Id AVP in answer messages.

In 3GPP TS 29.273 V8.0.0 Section 5.2.2.3.4

---------------------------------------------

< AA-Answer > ::= < Diameter Header: 268, PXY, 16777250 >

< Session-Id >

{ Auth-Application-Id }

{ Auth-Request-Type }

{ Result-Code }

[ Experimental-Result ]

{ Origin-Host }

{ Origin-Realm }

[ Session-Timeout ]

[ Accounting-Interim-Interval ]

*[ APN-Configuration ]

...

*[ AVP ]

According to this spec, Auth-Application-Id is a mandatory AVP in
AA-Answer message.

I have following questions:

*	Is it necessary to have Auth-Application-Id AVP as a mandatory
AVP in answer message? 
*	Is there any specific use by mandating it? Can't we have it as
an optional AVP ([Auth-Application-Id])?

Please help me to understand this.

Thanks,

Avinash Gowda

---

From: jouni korhonen <[email-masked]>
Date: Thu, 26 Feb 2009 09:22:22 +0200

Hi,

On Feb 26, 2009, at 8:53 AM, Gowda, Avinash wrote:

> …
> According to this spec, Auth-Application-Id is a mandatory AVP in AA- 
> Answer message.
>
> 	• Is it necessary to have Auth-Application-Id AVP as a mandatory  
> AVP in answer message?

RFC4005 which defines the AAA has { Auth-Application-Id }. So the  
above is correct according to the RFC.

> 	• Is there any specific use by mandating it? Can’t we have it as an  
> optional AVP ([Auth-Application-Id])?

Honestly, I have no history data why {} is used. You cannot really  
change it without causing an allocation of a new Command Code (as it  
would be a change in ABNF).

While you are at this, the Command Code is actually wrong. It should  
be 265, not 268.

Btw, you should bring these questions to 3GPP CT4 mailing list (http://list.etsi.org/3gpp_tsg_ct_wg4.html 
) as CT4 owns this spec and the work is done there. You might also  
want to wait few days for the latest spec version (there was a meeting  
last week).

> Please help me to understand this.

Cheers,
	Jouni

>
> Thanks,
> Avinash Gowda
>
> _______________________________________________
> DiME mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dime

---

From: Ankit Kumar Sharma <[email-masked]>
Date: Thu, 26 Feb 2009 16:48:06 +0530

Please see my comments inline...
________________________________
From: [email-masked] [mailto:[email-masked]] On Behalf Of Gowda, Avinash
Sent: Thursday, February 26, 2009 12:24 PM
To: [email-masked]
Subject: [Dime] Question on Auth-Application-Id AVP in Diameter answermessages

Hi All,

According to this spec, Auth-Application-Id is a mandatory AVP in AA-Answer message.

 *   Is it necessary to have Auth-Application-Id AVP as a mandatory AVP in answer message?
       <Yes, because specs are mandating it>

 *   Is there any specific use by mandating it? Can't we have it as an optional AVP ([Auth-Application-Id])?
       <I could think of a scenario where we have more than one User Diameter applications in a single process on our local node, and each one is capable of sending AAR command for ex. we have NASREQ and Tx . In this case, Auth-Application-Id could be used to route the incoming AAA from peer to correct local application module. In this example, user wants to be authenticated on two different interfaces and Auth-Application-Id is used to distinguish the answers of both requests>

Thanks,
Avinash Gowda

Regards,
Ankit

________________________________
"DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of the individual to whom it is addressed. It may contain privileged or confidential information and should not be circulated or used for any purpose other than for what it is intended. If you have received this message in error,please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus."

---

From: Mark Jones <[email-masked]>
Date: Thu, 26 Feb 2009 10:20:09 -0500

Comments inline...

________________________________
From: [email-masked] [mailto:[email-masked]] On Behalf Of Ankit Kumar Sharma
Sent: February 26, 2009 06:18
To: Gowda, Avinash; [email-masked]
Subject: Re: [Dime] Question on Auth-Application-Id AVP in Diameter answermessages

Hi All,

[mj] And those spec writers are infallibull ;) But seriously, if you search the DIME archives, you'll find the same question and the issue was addressed in the design guidelines (section 8.1) and 3588bis (section 3 and 6.1.6). In the meantime, the existing ABNF must be followed and {} makes this a required AVP.

[mj] The Auth/Acct/Vendor-Specific-Application-Id AVPs should not be used for routing given that the Diameter header already contains an application id and "the value of the application id in the header MUST be the same as any relevant application-id AVPs contained in the message" (section 3 in 3588bis). And as Jouni said, if you know of specifications where this is not the case, please take the issue up with the SDO concerned.

Thanks,
Avinash Gowda

Regards,
Ankit

---

From: "Gowda, Avinash" <[email-masked]>
Date: Thu, 26 Feb 2009 22:28:01 +0530

Hi Ankit,

As per RFC 3588 Bis15

6.8.  Auth-Application-Id AVP

   The Auth-Application-Id AVP (AVP Code 258) is of type Unsigned32 and
   is used in order to advertise support of the Authentication and
   Authorization portion of an application (see Section 2.4
<http://tools.ietf.org/html/draft-ietf-dime-rfc3588bis-12#section-2.4>
).  If
   present in a message other than CER and CEA, the value of the Auth-
   Application-Id AVP MUST match the Application Id present in the
   Diameter message header.

When the same Application-Id is present in Diameter Header then what is
the necessity of having duplicate data in this Auth-Application-Id AVP?

Thanks,

Avinash Gowda

From: Ankit Kumar Sharma [mailto:[email-masked]] 
Sent: Thursday, February 26, 2009 4:48 PM
To: Gowda, Avinash; [email-masked]
Subject: RE: [Dime] Question on Auth-Application-Id AVP in Diameter
answermessages

From: [email-masked] [mailto:[email-masked]] On Behalf Of
Gowda, Avinash
Sent: Thursday, February 26, 2009 12:24 PM
To: [email-masked]
Subject: [Dime] Question on Auth-Application-Id AVP in Diameter
answermessages

Hi All,

< Session-Id >

{ Auth-Application-Id }

{ Auth-Request-Type }

{ Result-Code }

[ Experimental-Result ]

{ Origin-Host }

{ Origin-Realm }

[ Session-Timeout ]

*[ APN-Configuration ]

...

*[ AVP ]

       <I could think of a scenario where we have more than one User
Diameter applications in a single process on our local node, and each
one is capable of sending AAR command for ex. we have NASREQ and Tx . In
this case, Auth-Application-Id could be used to route the incoming AAA
from peer to correct local application module. In this example, user
wants to be authenticated on two different interfaces and
Auth-Application-Id is used to distinguish the answers of both requests>

 

Thanks,

Avinash Gowda

Regards,

Ankit

"DISCLAIMER: This message is proprietary to Aricent and is intended
solely for the use of the individual to whom it is addressed. It may
contain privileged or confidential information and should not be
circulated or used for any purpose other than for what it is intended.
If you have received this message in error,please notify the originator
immediately. If you are not the intended recipient, you are notified
that you are strictly prohibited from using, copying, altering, or
disclosing the contents of this message. Aricent accepts no
responsibility for loss or damage arising from the use of the
information transmitted by this email including damage from virus."