Subject: RE: Issue 8

From: <[email-masked]>
Date: Wed, 11 Jun 2003 12:56:33 +0300

Alper,

Here are some comments.

- We need a grace period too:
  Authorization-Lifetime + Auth-Grace-Period <= Session-Timeout
Here
  Auth-Grace-Period < Authorization-Lifetime
Unit is seconds. Auth-Grace-Period is a configurable parameter 
and delivered from PAA to PaC. 

- PaC should propose something and PAA then decides the actual 
refresh period and session lifetime (the network knows better 
the upper and lower limits for re-auth etc.). PaC can optionally 
propose a Authorization-Lifetime to PAA within a PANA-Auth-Request 
message. PAA sends Authorization-Lifetime and Auth-Grace-Period 
AVPs to PaC in PANA-Result-Request message. PAA can also send 
Session-Timeout AVP to denote the total lifetime of the session.

- PANA-Reauth-Request from PAA can optionally contain 
Authorization-Lifetime AVP to denote the re-auth interval 
(if network wants to change it)?

Br,
- Dan

> -----Original Message-----
> From: ext Alper Yegin [mailto:[email-masked]]
> Sent: 11 June, 2003 00:10
> To: [email-masked]
> Subject: Issue 8
> 
> 
> 
> http://danforsberg.info:8080/pana-issues/issue8
> 
> 
> How about if we:
> 
> - define a refresh (re-auth) lifetime AVP.
> - PAA MUST include this AVP in the PANA_success to provide the maximum
> allowed refresh lifetime for the PANA session.
> - PAA MAY include this AVP in the PANA_success_ack to lower 
> the required
> PANA refresh lifetime.
> 
> At the end of PANA_success round, both PAA and PaC knows the refresh
> frequency. 
> 
> PaC MAY send PANA_reauth before this period expires. PAA MUST send
> PANA-reauth if there was no PANA-reauth exchange for one full period.
> 
> Comments?
> 
> Alper
> 
>

---

From: Alper Yegin <[email-masked]>
Date: Wed, 11 Jun 2003 11:48:28 -0700

Dan,

> and delivered from PAA to PaC.

I agree there might be a grace period, but I think this can be a local
decision (via implementation, configuration). Does the protocol have to
carry this information to the other end (PaC)?

> the upper and lower limits for re-auth etc.).

Now that I'm thinking, maybe we should only pass the Session-lifetime
between PAA and PaC, and not worry about Reauth-lifetime. PaC and PAA don't
need to share the Reauth-lifetime, each can trigger reauth as often as they
like/need. But for Session-lifetime, PaC should know it so that it can
perform PANA authentication again before its session expires and PAA
disables network access.

> PaC can optionally
> message. 

I also thought about first PaC requesting a value and PAA granting one. But
then looking at the message flows, the other direction seems to better fit
the current design. Instead of one of the PANA-auth messages carrying this
info from PaC to PAA, and the response coming back in PANA-success, I think
doing it symmetrically in PANA-success/ack is better. PANA module on the PaC
won't really know in which PANA-auth message this AVP should be included.

> PAA sends Authorization-Lifetime and Auth-Grace-Period

I don't think we need to pass the grace-period to the PaC. (well, if we do,
it is no longer seen as grace period, but as part of granted period :)

How about this:

- PAA sends (offered) session-lifetime in PANA-success message to the PaC.
If PaC wants to lower the session-lifetime, it MAY include a lower
session-lifetime in PANA-success-ack.

- It's the responsibility of PaC to perform PANA before its current session
expires. [note: here we are talking about full authentication where an EAP
method is executed, not re-auth]

- Both PaC and PAA can initiate re-auth whenever they need to.

Does this make sense?

Alper