Subject: RE: [Dime] Consensus Call regarding Diameter Mobile IPv6 HA-to-AAAHsupport

From: "MORAND Lionel RD-CORE-ISS" <[email-masked]>
Date: Fri, 16 Mar 2007 10:13:17 +0100

I think that the discussion is at least focused on the Diameter MIPv6 application in this thread ;)
My point was and still is that if authentication procedures are required by a given application, these procedures should be defined within the same application because authentication and authorization are tighly coupled (that is the case for me in the diameter MIPv6 application). 
That doesn't preclude the definition of diameter applications not relying on any authentication procedures. cf. some Diameter applications defined in 3GPP or TISPAN (e.g. Sh application) mainly used for user/service profile handling, unrelated to any authentication procedure.
It is therefore something that must be discussed case-by-case. And another thread can be opened for Diameter QoS application if needed.

Lionel

> -----Message d'origine-----
> De : Yoshihiro Ohba [mailto:[email-masked]] 
> Envoyé : vendredi 16 mars 2007 01:34
> À : Hannes Tschofenig
> Cc : [email-masked]
> Objet : Re: [Dime] Consensus Call regarding Diameter Mobile 
> IPv6 HA-to-AAAHsupport
> 
> As I repeatedly mentioned over this mailing list, I strongly 
> believe that separation of authentication and authorization 
> is the best way to proceed for MIPv6 HA-to-AAAH in terms of 
> modularity.  I failed to understand what exactly the actual 
> complexity associated with approach is.  I also do not 
> understand how people who agree with the combined 
> authentication and authorization approach can also agree with 
> Diameter QoS application which is separately defined from 
> authentication.
> 
> Finally, I also have an implementation issue with the 
> combined authentication and authorization approach for Open 
> Diameter in which a philosophy of "no code duplicate" among 
> different applications/libraries has been applied in order to 
> avoid a problem with changing one Diameter application 
> library but forgetting to make the same change for a similar 
> Diameter application library as much as possible.  There may 
> be some ugly implementation technique to avoid code 
> duplicate, which I don't like to see in Open Diameter.
> 
> Best Regards,
> Yoshihiro Ohba
> 
> 
> 
> On Wed, Mar 14, 2007 at 10:21:48PM +0100, Hannes Tschofenig wrote:
> > Hi all,
> > 
> > with our work on the "Diameter Mobile IPv6  HA-to-AAAH support" 
> > document (see
> > 
> http://www.ietf.org/internet-drafts/draft-ietf-dime-mip6-split-01.txt)
> > we defined a new Diameter application and we then decided that we 
> > should separate the authentication and authorization interaction to 
> > avoid an update of this specification when RFC 4072 is 
> updated. This 
> > means that the Diameter MIPv6 app-ID is used for the authorization 
> > part and the Diameter EAP app-ID is used for the 
> authentication part. 
> > Diameter routing may cause authentication and authorization 
> messages 
> > to be routed to different servers. This caused a lengthy 
> debate on security issues.
> > It seems that there is a lot of complexity associated with 
> this approach.
> > 
> > I would therefore like to hear whether working group members are OK 
> > with performing authentication and authorization as part of one 
> > Diameter application. This would therefore mean that we are 
> going to 
> > use the Diameter MIPv6 app-ID for authentication and for 
> authorization.
> > 
> > Please state your opinion.
> > 
> > Ciao
> > Hannes
> > 
> > 
> > _______________________________________________
> > DiME mailing list
> > [email-masked]
> > https://www1.ietf.org/mailman/listinfo/dime
> > 
> 
> _______________________________________________
> DiME mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/dime
> 
> 

_______________________________________________
DiME mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dime