Subject: [AAA-WG]: Issue: 8.1 Authorization Session State Machine

From: "Fredrik Johansson" <[email-masked]>
Date: Wed, 29 Aug 2001 11:06:08 +0200

Submitter name: Fredrik Johansson
Submitter email address: [email-masked]
Date first submitted: 2001-08-29
Reference:
Document: base
Comment type: E
Priority: 1
Section:
Rationale/Explanation of issue:

There are some missing states in the authorization session state machine.

1. It is optional to send a ASR when cleaning up a session on a home server,
however there is no indication on what state to go to when doing so. My
guess is that you should go to Disconnect and wait for a ASA. Since this is
an optional feature I'm not sure it should be in the state machine. However,
if you send an ASA there has to be a state indicating how to get from
Disconnect to Closed.

Requested Change:

Add the following state

Discon	ASA Received	Cleanup	Closed
BTW, it might just be a cut'n past error, the
Open		ASA Received	Cleanup	Closed
state should not exist, if you have sent an ASR you should not be in Open,
so replace the latter with the first state above.

2. There is no state where the home server can receive a service specific
auth. request and extend access and stay in open.

Requested Change:
Add a the following state:
Open		Successful Service-Specific 		Extend	Open
		Authorization Request received	Access

3. There is no state where the home server can receive a STR send a STA and
go to Closed

Requested Change:
Add the following state:
Open		receive STR					send STA	Closed

4. According to the following state:
Open	Authorization-Lifetime 				Send		Open
	expires on access device			service
								specific
								auth req

It's not clear that an access device can not send a Service-Specific Auth.
request on Authorization-Lifetime expiration unless it has received a MIP
registration request or PPP request.

Requested Change:
Can it be made clearer that if no such message has been received it should
send a STR and go to Disconnect?

---

From: Pat Calhoun <[email-masked]>
Date: Wed, 29 Aug 2001 06:57:19 -0700

> so replace the latter with the first state above.

Actually, the following

should have been

Discon	ASA Received	Cleanup	Idle

> 		Authorization Request received	Access

but -07 already has this exact state.

> Open		receive STR					send STA	Closed

Actually, it should be

Open	STR Received	Send STA	Discon

> send a STR and go to Disconnect?

but this is service specific. If I was to add such language, it could break
the state machine for future apps that don't operate this way. I will assume
that the implementor knows that some access protocol interactions are necessary
with the user, and leave it undefined.

PatC

---

From: "Fredrik Johansson" <[email-masked]>
Date: Wed, 29 Aug 2001 17:22:31 +0200

>Discon	ASA Received	Cleanup	Idle

why Idle?! the session has been killed, and confirmation has been received
that it has been killed on the other end as well.

>but -07 already has this exact state.

where?!? I can only find
Open		Successful Service-Specific		Extend 	Open
		Authrorizatio Answer received		Access
				  ^^^^^^

>Open	STR Received	Send STA	Discon

Why go to Discon, how do you get from Discon to Closed?

>with the user, and leave it undefined.

It does however break the two existing applications.
is it that likely that there will be an application in the future that
allows authentication that is not initated by the authenticated device.
Would not such an application suffer from vulnerability to replay attacks? I
beleive that the transition should be

Open	Authorization-Lifetime			send STR		Discon
	expires on access device

since the authenticated device would have requested re-authentication before
the auth-lifetime expires if it cares to continue the service. And the
latter shoudl be covered by the following transition

Open	Client or Device Request access	send Service-Spec		Open
							auth req

/Fredrik

---

From: Pat Calhoun <[email-masked]>
Date: Wed, 29 Aug 2001 15:39:16 -0700

> that it has been killed on the other end as well.

all this was changed as a result of a previous issue. The term closed was
strange, since it implied that the session control block would remain
in memory and marked as closed. Further, the author of the issue, for which
I posted proposed text, claimed that it was difficult to distinguish
the difference between closed and discon.

In any case, here is the latest state machine (in the soon to be -08):
State     Event                          Action     New State
-------------------------------------------------------------
Idle      Client or Device Requests      send       Pending
          access                         service
                                         specific
                                         auth req

Idle      Service-Specific authorization send serv. Open
          request received, and          specific
          successfully processed         answer

Pending   Successful Service-Specific    Grant      Open
          Authorization answer           Access
          received with default
          Auth-Session-State value

Pending   Successful Service-Specific    Sent STR   Discon
          authorization answer received
          but service not provided

Pending   Error processing successful    Sent STR   Discon
          Service-Specific authorization
          answer

Open      Authorization-Lifetime         send       Open
          expires on access device       service
                                         specific
                                         auth req

Open      Successful Service-Specific    Extend     Open
          Authorization answer           Access
          received

Open      Accounting message sent or     process    Open
          received

Open      Failed Service-Specific        Discon.    Idle
          Authorization answer           user/device
          received.

Open      Session-Timeout Expires on     send STR   Discon
          Access Device

Open      ASR Received                   send ASA,  Discon
                                         STR

Open      Authorization-Lifetime (and    Cleanup    Discon
          Auth-Grace-Period) expires
          on home server.

Open      Session-Timeout expires on     Cleanup    Discon
          home server

Discon    ASR Received                   None       Discon

Discon    STR Received                   Send STA   Idle

Discon    STA Received                   Discon.    Idle
                                         user/device

> 		Authrorizatio Answer received		Access

oops.... my eyeball diff obviously failed :(

> Why go to Discon, how do you get from Discon to Closed?

See above.

> Open	Client or Device Request access	send Service-Spec		Open

ok

PatC

---

From: Pat Calhoun <[email-masked]>
Date: Wed, 29 Aug 2001 15:44:38 -0700

> > Open	Authorization-Lifetime			send STR		Discon

Actually, I believe that the correct state table entry is the following:

Open      Authorization-Lifetime +       send STR   Open
          Auth-Grace-Period expires on 
          access device

PatC

---

From: "Fredrik Johansson" <[email-masked]>
Date: Thu, 30 Aug 2001 11:23:53 +0200

>          Auth-Grace-Period expires on

Why?
First of all it seems strange to close try to close a session and still stay
in open. And secondly, there is no transition from Open that receives a STA
and goes to Idle. I believe it's more logical to go to Discon when sending
STR and go from Discon to Idle when receiving STA.

/Fredrik

---

From: Pat Calhoun <[email-masked]>
Date: Thu, 30 Aug 2001 06:18:49 -0700

> >          Auth-Grace-Period expires on

mostly due to sleep deprivation.

> STR and go from Discon to Idle when receiving STA.

Of course, the transition state should have been Discon.

PatC