Subject: Re: (radius) Class.

From: Barney Wolff <[email-masked]>
Date: Mon, 18 Jan 1999 17:48 EST

This does point up our near-total underspecification of proxy behavior.
My own auth proxy encapsulates the "real" server's Class in its own, and
then the acct proxy unearths it to send to the "real" acct server.  I
am here depending on having the same implementation (not the same host)
as both auth and acct proxies.  Once in a while a misconfiguration causes
that to be violated, and I do have code to avoid disaster when Class
doesn't look as expected.
So I should really have said that Class "only" needs to be agreed between
servers and at each level of proxy.

Barney

> From: Aydin Edguer <[email-masked]>
> Date: Mon, 18 Jan 1999 15:58:29 -0500 (EST)
> 
> > Well, no.  The server can put more than one piece of info in Class.
> > Only the auth and acct servers have to agree on the interpretation of
> > the attribute.
> 
> If there is only one server involved, Class is simple and useful.  But
> there can be multiple servers involved in a roaming situation, which can
> lead to conflicting uses of the Class attribute.  The issue of two auth
> servers wishing to add different Class attributes is non-trivial to resolve
> within the protocol.  It can, of course, be resolved externally to the
> protocol by agreements between organizations and enforced using attribute
> filtering (another controversial area of RADIUS).
-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.

---

From: MARC DE VRIES WE41/KT <[email-masked]>
Date: Wed, 20 Jan 1999 13:32:33 +0200 (MET-DST)

Just a thought:

I have seen multiple Class attributes in Access-Accept, all of which returned
in Accounting-Request (tested with only one NAS type). 

You can have the two Class implementations (session-id and group) using two
distict attribute instances or a single one.

Access-Accept:
  Class = "realm:faraway.com;auth-session-id:123456"

or

Access-Accept:
  Class = "realm:faraway.com",
  Class = "auth-session-id:123456"

For roaming, using multiple class attributes may be better than class-in-class
encapsulation because of the attribute length limit.

Marc.

-