Subject: Re: (radius) Class.

From: Barney Wolff <[email-masked]>
Date: Mon, 18 Jan 1999 15:32 EST

Well, no.  The server can put more than one piece of info in Class.
Only the auth and acct servers have to agree on the interpretation of
the attribute.

Barney Wolff  <[email-masked]>

> From: Aydin Edguer <[email-masked]>
> Date: Mon, 18 Jan 1999 14:19:34 -0500 (EST)
> 
> Example #1 - Class can be used to categorize users and allow summaries
> of usage on a Class basis by a RADIUS accounting server, without having
> to have access to a database to link a username and a class.
> 
> Example #2 - Class can be used to add a non-guessable unique value to
> accounting responses to help minimize the risk of additional fraudulent 
> billing records.  It does not eliminate the risk, and the originating
> NAS can still change the time of records, but it is more difficult to
> generate additional session records.
> 
> These two uses are conflicting and really depends upon the environment
> and the RADIUS server.
-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.

---

From: Aydin Edguer <[email-masked]>
Date: Mon, 18 Jan 1999 15:58:29 -0500 (EST)

> Only the auth and acct servers have to agree on the interpretation of

If there is only one server involved, Class is simple and useful.  But
there can be multiple servers involved in a roaming situation, which can
lead to conflicting uses of the Class attribute.  The issue of two auth
servers wishing to add different Class attributes is non-trivial to resolve
within the protocol.  It can, of course, be resolved externally to the
protocol by agreements between organizations and enforced using attribute
filtering (another controversial area of RADIUS).

-