Subject: RE: comments on draft-ietf-nasreq-criteria-03.txt

From: Robert Pluim <[email-masked]>
Date: Sat, 16 Oct 1999 18:45:49 +0200 (CEST)

Bernard Aboba writes:
 > >What if one of the two servers disagrees about whether a non-editable
 > >attribute should be editable or not? Do you drop the packet? Or do you
 > >remove the offending attribute? (I can think of at least one real-life
 > >example here, involving multilink).
 > 
 > Can you describe the real-life example?

(I already discussed this with Randy Bush, and we decided it was more
applicable to aaa than nasreq, but here goes anyway).

Suppose someone is dialing in to an ISP that is not his home one. The
AAA request for him goes to his home ISP via a broker. There is a
contract in place between the two ISPs, but it does not cover
multink. The home server returns an accept with a Port-Limit of 2,
say, and marks it as non-editable (otherwise someone intermediary could
increase it). The intermediate broker wants to change this Port-Limit
to 1, since it has no contract covering multink in place, but it
can't, since the attribute is non-editable.

-- 
Robert Pluim                               Voice:  +33 4 92 96 17 43
Systems Development Engineer                 Fax:  +33 4 92 96 15 32
EMEA Data R&D
Nortel Networks               <URL:mailto:[email-masked]>

---

From: Randy Bush <[email-masked]>
Date: Sun, 17 Oct 1999 00:12:59 -0700

> can't, since the attribute is non-editable.

why does the broker care?  the two end systems make the decisions and
the broker merely has to help the client find the authentication and
authorization server.

randy