Subject: Re: [AAA-WG]: Session Termination Issues

From: Paul Funk <[email-masked]>
Date: Mon, 07 May 2001 00:35:27 -0400

Pat,

At 02:21 PM 5/3/01 -0700, you wrote:
>As far as eliminating the STI, in favor for allowing the STR to be initiated
>by either the server or the client, I haven't received comments from the WG
>in favor of this approach. 

I'm not proposing that either a client or a server can issue an STR. 
Only the entity that is providing the service -- the client -- knows 
when the session has terminated, and therefore only the client 
can issue the STR. The STR, in my view, is a notification by the 
client to the home server and all proxies in between that the session 
is over. This allows those servers to release whatever resources or 
session information they are holding.

What I am proposing is this: If a server -- any server -- wants to abort 
a user's session, it issues a special request to the client, say, 
Session-Kill-Request, and the client responds with a 
Session-Kill-Answer. I prefer using two-way messaging such as 
SKR/SKA rather than STI.

Let's call the server that issued the SKR the "terminator" server.

When the client receives the SKR, it aborts the session and responds 
to the terminator server with an SKA. Or, it refuses to abort the session 
and responds with SKA indicating its refusal. Also, the client will issue 
an STR to the server that originally authenticated/authorized that 
session -- it would do this even if the session terminated normally via 
user logoff.  So the SKR/SKA and the STR/STA are independent 
transactions.

If the terminator server is the same server as the authenticating server 
or any of the proxies in between, it will see the STR; if not, it won't. 
But it's OK either way. Each server will receive the information that is 
appropriate to its role, whether authenticator, terminator, or both.

Basically, what it comes down is that using Request/Answer to kill a 
session is superior to Indication because there is explicit 
acknowledgement. The terminator server doesn't have to be in the 
proxy chain to the authenticating server to get the acknowledgement.

Paul

Paul Funk
Funk Software, Inc.
617 497-6339
[email-masked]