Subject: RE: [AAA-WG]: Issue: 8.1 Authorization Session State Machine

From: Thomas Panagiotis-PTHOMAS1 <[email-masked]>
Date: Thu, 30 Aug 2001 22:36:52 -0500

Pat, please consider my suggestions below.

State Machine - state maintained:
-----------------------------------------------------
Add the following transitions:

Pending   Failed serv. specific     Cleanup         Idle
          auth-answer received

Open      Authorization-Lifetime    send serv.      Open
          expires on access         specific
          device                    Auth-Request

Open      Home server wants to      send ASR        Discon
          terminate the service

Replace, 

> Idle     Service-Specific         send serv.      Open
>          authorization request    specific
>          received, and            answer
>          successfully processed 

with,

Idle      serv. specific auth-      send Successful  Open
          request received, and     serv. specific
          user is authorized        Auth-Answer

Idle      Service-Specific auth-    send Failed      Idle
          request received, and     serv. specific
          user is not authorized    Auth-Answer

Replace,
 
> Open      Successful Service-Specific    Extend    Open
>           Authorization request or       Access
>           answer received

with,

Open   serv. specific auth-         send Successful  Open
       request received, and        serv. specific                    
       user is authorized           Auth-Answer

Open   serv. specific auth-         send Failed      Idle
       request received, and        serv. specific                    
       user is not authorized       Auth-Answer,
                                    Cleanup

Open   Successful serv. specific    Extend Access    Open
       auth-answer received       

State Machine - no state maintained:
------------------------------------------------------------

Add the following transition:

Pending   Failed serv. specific      Cleanup   Idle
          auth-answer received.

Thanks,

-Panos

-----Original Message-----
From: Pat Calhoun [mailto:[email-masked]]
Sent: Wednesday, August 29, 2001 5:47 PM
To: Thomas Panagiotis-PTHOMAS1
Cc: 'Pat Calhoun'; Fredrik Johansson; [email-masked]'
Subject: Re: [AAA-WG]: Issue: 8.1 Authorization Session State Machine

On Wed, Aug 29, 2001 at 10:36:47AM -0500, Thomas Panagiotis-PTHOMAS1 wrote:
> Most of my comments are in alignment with Fredrik's last
> message.
> 

Please take a look at the complete state table below (I just realized that
I only sent a portion of it in my response to Fredrik). These changes were
the result of issues that have since been closed. Any comments on this
state table would be most appreciated:

State     Event                          Action     New State
-------------------------------------------------------------
Idle      Client or Device Requests      send       Pending
          access                         service
                                         specific
                                         auth req

Idle      Service-Specific authorization send serv. Open
          request received, and          specific
          successfully processed         answer

Pending   Successful Service-Specific    Grant      Open
          Authorization answer           Access
          received with default
          Auth-Session-State value

Pending   Successful Service-Specific    Sent STR   Discon
          authorization answer received
          but service not provided

Pending   Error processing successful    Sent STR   Discon
          Service-Specific authorization
          answer

Open      user or client device          send       Open
          requests access to service     service
                                         specific
                                         auth req

Open      Authorization-Lifetime +       send STR   Open
          Auth-Grace-Period expires on 
          access device

Open      Successful Service-Specific    Extend     Open
          Authorization request or       Access
          answer received

Open      Accounting message sent or     process    Open
          received

Open      Failed Service-Specific        Discon.    Idle
          Authorization answer           user/device
          received.

Open      Session-Timeout Expires on     send STR   Discon
          Access Device

Open      ASR Received                   send ASA,  Discon
                                         STR

Open      Authorization-Lifetime (and    Cleanup    Discon
          Auth-Grace-Period) expires
          on home server.

Open      Session-Timeout expires on     Cleanup    Discon
          home server

Open      STR Received                   Send STA   Discon

Discon    ASA Received                   Cleanup    Idle

Discon    ASR Received                   None       Discon

Discon    STR Received                   Send STA   Idle

Discon    STA Received                   Discon.    Idle
                                         user/device

The following state machine is used when state is not maintained
on the server:

State     Event                          Action     New State
-------------------------------------------------------------
Idle      Client or Device Requests      send       Pending
          access                         service
                                         specific
                                         auth req

Idle      Service-Specific authorization send serv. Open
          request received, and          specific
          successfully processed         answer

Pending   Successful Service-Specific    Grant      Open
          Authorization answer           Access
          received with Auth-Session-
          State set to
          NO_STATE_MAINTAINED

Open      Accounting message sent or     process    Open
          received

Open      Session-Timeout Expires on     Discon.    Idle
          Access Device                  user/device

Open      Service to user is terminated  Discon.    Idle
                                         user/device

PatC

---

From: Pat Calhoun <[email-masked]>
Date: Thu, 30 Aug 2001 20:31:20 -0700

Those are reasonable changes. I will make the necessary changes.

PatC

---

From: Pat Calhoun <[email-masked]>
Date: Thu, 30 Aug 2001 20:35:54 -0700

Wait - ignore my acceptance of this issue.

see comments below.

> Pending   Failed serv. specific     Cleanup         Idle

ok

>           expires on access         specific

I had this, and this issue was a request to change the above to:

and

Open      Authorization-Lifetime +       send STR   Discon
          Auth-Grace-Period expires on 
          access device

The reasoning is that the user must request access to the network, which
initiates the auth request. Then, if the user doesn't request access,
and the auth-lifetime expires, the STR is sent to the server.

Your request to make the above change contradicts the above text, and I
feel more comfortable with the existing text.

The rest I feel comfortable with.

PatC