Subject: [Dime] Need to know the location of a roaming peer?

From: Sebastien Decugis <[email-masked]>
Date: Tue, 17 Nov 2009 14:21:57 +0900

Hello all,

During the last meeting (thanks Hannes and Jouni for the minutes) there
was a discussion about the need (or absence of need) to notify the home
domain when a peer changes its authenticator in a visited domain. During
the discussion on ERP, my understanding of the conclusion was that we
should do the re-authentication locally when possible in the visited
domain, without going back to home domain. Then, in case new
authorization attributes are needed, we have a separate exchange with
the home realm to fetch these fresh authorization attributes, after the
authentication is performed.

Later during the session, a remark on emergency services (related to
Diameter Parameter Query draft if I am not mistaken) sent the question
back on the table, highlighting that in some contexts we may want to
query the home server for the current location of the user. I am
wondering, if the peer can move without the home server being notified
(we assume server-initiated messages are routed transparently to the
correct recipient) then the design of such query mechanism will be
affected and complexity added.

I would like to ask the list if there is strong concerns with "hiding"
the current authenticator of a roaming user to the home server, the
result being that the home realm only knows the current location with a
granularity of the realm (inter-realm handovers should still have to go
to the home realm, AFAIU).

PS: I am wondering, in the context of emergency services, if we are
really interested by the authenticator or by the point of attachment for
the given peer, as I understand there is a difference in some deployment
schemes...

Thank you for any comment,

Best regards,
Sebastien.

-- 
Sebastien Decugis
Research fellow
Network Architecture Group
NICT (nict.go.jp)

---

From: w52006 <[email-masked]>
Date: Thu, 26 Nov 2009 09:06:43 +0800

Hello

Mostly I agree your concern too. Please see one comment as below...

B.R.
Yungui Wang

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of Sebastien Decugis
> Sent: Tuesday, November 17, 2009 1:22 PM
> To: [email-masked]
> Subject: [Dime] Need to know the location of a roaming peer?
> 
> Hello all,
> 
> domain, without going back to home domain. 

> Then, in case new
> the home realm to fetch these fresh authorization attributes, 
> after the authentication is performed.

As described In section 5.3 of RFC5296, the realm part of keyName-NAI is the
local (ER server's) domain name. How can the new NAS know that the
authorization attributes should be freshed to the home server? Does other
entity (e.g. the ER server) do? 

In addition, when the peer moves to the new NAS, the old NAS should delete
the original authentication session with the home server. In this way, is it
acceptable for home server without peer's authentication session while new
authorization session is freshed/reserved?

> _______________________________________________
> DiME mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dime
>