Subject: [AAA-WG]: [issue] PDSA-Request without DSA-Target-Realm

From: Miguel Ángel Monjas Llorente <[email-masked]>
Date: Fri, 14 Sep 2001 16:05:07 +0200

Submitter name: Miguel A. Monjas
Submitter email address: [email-masked] 
Date first submitted: 2001-09-14
Reference: 
Document: CMS-02
Comment type: T
Priority: 1
Section: 1.2
Rationale/Explanation of issue: 

The possibility of issueing a PDSA request without a DSA-Target-Realm
has been suggested as an optimized approach that allows to avoid a
explicit PDSA with any desired realm.

However, there are some points that remain unclear (IMHO):

- When does the proxy establish a DSA? As an initial establishment
with all the realms isn't possible, I suppose that every time the
client request an authorisation operation regarding a user, the proxy
must detect the operation and establish a DSA before forwarding the
authorisation message.

- Does the proxy has to establish a DSA with any realm? I don't think
so, since it may not be allowed by the proxy's local policies.

- What happens when one of such DSA fails? Or whether the proxy
doesn't support a DSA with the required realm? Or even whether there
is a another proxy on the route that issues a NOT_CMS_THROUGH_PROXY
result code? Do the proxy have to indicate it to the client, issuing
an appropriate answer with a given result-code (maybe
DIAMETER_NO_DSA_ESTABLISHED)? Or it must forward the message without
warning the client?

- Are all the clients equal? I mean, does the proxy have to record on
behalf of which client it is establishing a DSA (what might involve
several DSAs with the same realm on behalf of different clients)?

- What happens when the DSA expires? Does the proxy have to
re-establish it without any indication from the client. If so, the
third model suggested in one of my previous issues would be better (no
explicit PDSAR to begin a DSA but just local policies of the proxy).

Requested change: 

a) Replace the following paragraph:

   An optimized approach also allows the PDSR to be sent by the access
   device without the DSAR-Target-Realm AVP. This message is used to
   inform the proxy that it MUST establish a Diameter security
   association for all realms it will be communicating with on behalf
   of the access device.

with something like the following:

   An optimized approach also allows the PDSAR to be sent by the
access
   device without the DSAR-Target-Realm AVP. This message is used to
   inform the proxy that it MUST establish a Diameter security
   association for all realms it will be communicating with on behalf
   of the access device. Such DSA MUST be established only first time
   a message must be routed to a given realm.

   It may happen that this DSA can not be established. For example,
   the proxy might be configured not to establish DSAs with the
required
   realm, the DSA setup migh fail or there is a proxy agent in the
   route towards the home server, and it returned a failure to the
   DSAR messages stating that it was not willing to allow the DSA to
   traverse through it. In such situations, the proxy MUST reject the
   message, but set the Result-Code AVP to
DIAMETER_NO_DSA_ESTABLISHED.
 
   If several access device send a PDSAR without the DSAR-Target-Realm
   AVP, only one DSA per realm MUST be established.

b) Add clarifying text regarding what happens when the DSA expires.

Regards

  // M.A.

-- 
  Miguel Angel Monjas Llorente
  Systems Engineer, GSM/UMTS Systems Management
  Ericsson España, S.A. (EEM) UMTS/GSM Databases
  Tel: +34 91 3393605                 Mob: +34 629 570196
  <mailto:[email-masked]>  Fax: +34 91 3392538
  Retama 1, 4th. 28045 Madrid - SPAIN -

---

From: Pat Calhoun <[email-masked]>
Date: Sun, 16 Sep 2001 08:45:09 -0700

How about the following text instead (which is a variant of the text
sent by Miguel):

An optimized approach also allows the PDSR to be sent by the
access device without the DSAR-Target-Realm AVP. This message is used to
inform the proxy that it MUST establish a Diameter security
association for all realms it will be communicating with on behalf
of the access device. DSAs are typically established once the first request
for a given realm has been recelived by the proxy agent, but it MAY
establish certain DSAs with known realm in advance.

If a DSA for a given realm cannot be established, the proxy agent 
MUST reject the access device's request, and set the Result-Code AVP
to DIAMETER_NO_DSA_ESTABLISHED. Although the proxy agent MAY receive
many PDSRs from access devices, only one DSA per realm MUST be 
established. Furthermore, the PDSR is responsible for re-establishing
the DSA prior to expiration without any involvement by the access device.

PatC

---

From: Miguel Ángel Monjas Llorente <[email-masked]>
Date: Mon, 17 Sep 2001 13:37:26 +0200

> established. Furthermore, the PDSR is responsible for re-establishing
                                ^^^^ proxy?
> the DSA prior to expiration without any involvement by the access device.

The rest is fine

Regards

  // M.A.

  Ombú 3, 10th. 28045 Madrid - SPAIN -