Subject: [Dime] Diameter application for PMIP6 (chargeable-User-ID) question

From: "Bibi Blocksberg" <[email-masked]>
Date: Wed, 16 Jul 2008 21:41:24 +0200

Hi all, 
 
 I've one question regarding the draft 'korhonen-dime-pmip6-03.txt'
 (http://tools.ietf.org/id/draft-korhonen-dime-pmip6-03.txt).

 If the MAG performs a user-authentication toward the HAAA 
 server, it uses the User-Name AVP to identify the MN. After a 
 successful authentication the HAAA server replies with a 
 Chargeable-User-Identity. 
 
 My question: Should the MAG use the Chargeable-User-Identity 
 for the PBU and its MN-ID option, or should the MAG use the 
 content of the User-Name AVP as MN-ID option in the PBU?
 
 Section 6.2 on page 14 says that the User-Name 
 AVP must contain the MN identity if the LMA sends a Diameter 
 message toward the HAAA server. The value for the User-Name 
 AVP the LMA has extracted from the received PBU (MN-ID option).
 
 In my view it isn't clear if the User-Name AVP toward the HAAA 
 server should contain the Chargeable-User-ID AVP content to authorize the 
 PBU, or if the AA-Request and its User-Name AVP contains 
 the NAI, which was initially used to authenticate the MN by the MAG?

 If the User-Name AVP toward the HAA server contains the Chargeable-User-ID 
 AVP content, then the real identity of the MN can be concealed from the
LMA, but 
 the HAAA server is able to identify the real identity of MN, as it has
assigned the 
 Chargeable User-ID.

 I hope, you can provide me with some information on this matter.
 
 Thanks you in advance
 
 Rafael 

_______________________________________________
DiME mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dime

---

From: Jouni Korhonen <[email-masked]>
Date: Thu, 17 Jul 2008 02:22:00 +0300

Hi Rafael,

>  content of the User-Name AVP as MN-ID option in the PBU?

If the Chargeable-User-Identity is returned then that identity
is to be used.

>  the NAI, which was initially used to authenticate the MN by the MAG?

The sequence is as follows:

MN -> MAG: identity1 = some auth method or link specific identity
MAG -> HAAA: User-Name = identity1
MAG <- HAAA: may return a new identity2 in Chargeable-user-Id
MAG -> LMA: PBU MN-ID = identity2, if available, otherwise
             PBU MN-ID = identity1
LMA -> HAAA: User-name = identity from PBU MN-ID i.e. may be
              identity1 or identity2

Hope this clarifies.

>  the HAAA server is able to identify the real identity of MN, as it  

Yes.

>  I hope, you can provide me with some information on this matter.

Cheers,
	Jouni