Subject: Re: [Dime] Diameter Mobile IPv6 HA-to-AAAH Support: Server Split

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 15 Nov 2006 21:48:24 +0100

Hi Kuntal,

thanks for your response.

you vote for a single server solution.

At what time exactly the authorization decision is made requires a 
separate discussion since it depends to some extend on the message 
exchanges between the MIPv6 bootstrapping solution and the AAA exchange. 
As such, the answer is different for the NAS<->AAAH and the HA<->AAAH 
protocol interaction. Julien posted some message flows to the list 
describing some of the challenges. We need to investigate these aspects 
in a separate mailing list thread.

Ciao
Hannes

Chowdhury, Kuntal wrote:
> Hi Hannes,
> 
> IMHO, at the time of EAP authentication the MS needs to be authorized
> for MIP6 service. This is because:
> 
> Regardless of whether EAP is used or some other auth method is used to
> authenticate the MN, the entity that is authenticating the MN is the
> MSA. The MSA by definition (Mobility Service Authorizer) needs to
> Authenticate and Authorize the MN. For HoA bootstrapping, at the time of
> IKEv2 transaction the HA needs to know whether the MN is authorized for
> mobility service (MIP6 in this case) or not. Therefore, the AAA server
> needs to either return an AVP along with EAP-Success to indicate to the
> HA that the MN is authorized for MIP6 service or the AAA server can
> return the address of another AAA server in the MSA that needs to be
> contacted for MIP6 authorization for the MN. 
> 
> I think the former (MIP6 authorization AVP along with EAP success) is a
> better option. In that case a single server for both auth and authz
> should be suffice.
> 
> -Kuntal
> 
> 
>> -----Original Message-----
>> From: Hannes Tschofenig [mailto:[email-masked]]
>> Sent: Friday, November 10, 2006 6:26 PM
>> To: [email-masked]
>> Subject: [Dime] Diameter Mobile IPv6 HA-to-AAAH Support: Server Split
>>
>> Hi all,
>>
>> during the DIME meeting Glen raised an important question that impacts
>> the design of the protocol, namely:
>> "
>> Do we need to support the scenario where the Diameter EAP
> authentication
>> and the Diameter MIPv6 authorization exchange terminate at different
>> servers?
>> "
>>
>> Currently, we assume that these two exchanges could be terminated at
>> different servers. As a  consequence, security concerns were raised
> (see
>> slide 5
>> of http://www3.ietf.org/proceedings/06nov/slides/dime-4.ppt).
>>
>> How do people think about restricting the Diameter MIPv6 HA-to-AAAH
>> document to terminate the authentication and authorization exchange at
>> the same server?
>>
>> Ciao
>> Hannes
>>
>> PS: Glen also suggested to consider using the Diameter MIPv6 App-ID
> for
>> the Diameter EAP exchange if we decide that both exchanges terminate
> at
>> the same server. As a consequence the open issue described at slide 6
> of
>> http://www3.ietf.org/proceedings/06nov/slides/dime-4.ppt would also be
>> resolved. The changes to the existing document would be minimal (about
> 2
>> additional sentences).
>>
>>
>> _______________________________________________
>> DiME mailing list
>> [email-masked]
>> https://www1.ietf.org/mailman/listinfo/dime
> 
> 
> "This email message and any attachments are confidential information of Starent Networks, Corp. The information transmitted may not be used to create or change any contractual obligations of Starent Networks, Corp.  Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon this e-mail and its attachments by persons or entities other than the intended recipient is prohibited. If you are not the intended recipient, please notify the sender immediately -- by replying to this message or by sending an email to [email-masked] -- and destroy all copies of this message and any attachments without reading or disclosing their contents. Thank you."

_______________________________________________
DiME mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dime