Subject: [AAA-WG]: RFC3588: Clarification of Session-Id, hosts, realms and FQDNs

From: [email-masked]
Date: Wed, 1 Sep 2004 12:16:10 +0200

While studying RFC3588, in particular the sesion-ID AVP (section 8.8) , I
am unclear how the first component (up to the first ";") is defined, and
how this identity relates to the Origin-Host and Origin-Realm AVPs.
"The Session-Id MUST begin with the sender's identity ..."

 section 4.4.1 gives an example for Session-ID:  grump.example.com;.....

section 6.1 has some more examples
 Origin-Host = nas.mno.net      and
Origin-Realm  = mno.net

Both Origin-Host and Origin-Realm are of type DiameterIdentity, which is
defined in section 4.3 to be Fully Qualified Domain Name

also section 6.3.says:
"The Origin-Host AVP (AVP Code 264) is of type DiameterIdentity, and
MUST be present in all Diameter messages. This AVP identifies the
endpoint that originated the Diameter message. Relay agents MUST NOT
modify this AVP.
The value of the Origin-Host AVP is guaranteed to be unique within a
single host."

This refers to the "endpoint" and the uniqueness of "Origin-Host" within a
"host".

All commands MUST include both Origin-Host and Origin-Realm.

Under what circumstances can the "tail-end" of the Origin-Host ever differ
from the "Origin-Realm"?

Is the "sender's identity" of the Session-Id exactly the Origin-Host?

I have searched the archives, but not found any info on this.  I fear that
I am missing some fundamental concept!

Can anybody point me in the right direction?

Thanks

Mike Hillier

=========================
Michael Hillier
Telenet AG- Rhein-Main

Mobile +49 170 5454 121

[email-masked]

---

From: <[email-masked]>
Date: Wed, 1 Sep 2004 17:02:15 +0300

[email-masked] wrote:
>
> While studying RFC3588, in particular the sesion-ID AVP
> (section 8.8) , I am unclear how the first component (up to
> the first ";") is defined, and how this identity relates to
> the Origin-Host and Origin-Realm AVPs.  "The Session-Id MUST
> begin with the sender's identity ..."
> 
> Both Origin-Host and Origin-Realm are of type
> DiameterIdentity, which is defined in section 4.3 to be Fully
> Qualified Domain Name
> 
> also section 6.3.says: "The Origin-Host AVP (AVP Code 264) is
> of type DiameterIdentity, and MUST be present in all Diameter
> messages. This AVP identifies the endpoint that originated the
> Diameter message. Relay agents MUST NOT modify this AVP.  The
> value of the Origin-Host AVP is guaranteed to be unique within
> a single host."
> 
> This refers to the "endpoint" and the uniqueness of
> "Origin-Host" within a "host".
> 
> Under what circumstances can the "tail-end" of the Origin-Host
> ever differ from the "Origin-Realm"?

There is no requirement that Origin-Realm has to be a suffix 
of Origin-Host (or Destination-Realm of Destination-Host).

So having e.g. host "ap1749.example.net" in realm "example.com" 
would be OK. And a single Diameter server could serve multiple 
different realms, but use the same Origin-Host value for all of 
them.

> Is the "sender's identity" of the Session-Id exactly the

When sending the first message of a particular session (and thus
creating a new Session-ID), a node probably puts the same value
to Origin-Host. But the value is there to provide uniqueness,
so a recipient of a Diameter message can't assume the Session-Id 
matches the Origin-Host AVP in the same message.

Best regards,
Pasi