Subject: Re: [radext] New Draft for RADIUS Extended Identifier Attribute

From: "Satyanarayana Danda (sdanda)" <[email-masked]>
Date: Thu, 12 Nov 2015 18:04:32 +0000

Most of the efficient implementations would have Identifier as one of the keys for Request/Response match lookup.

With this new AVP

  1.  have you thought about any performance considerations?
  2.  In the TLV buffer, do you suggest the position of the new AVP? if so are we breaking any existing recommendation of the TLV positions?

Thanks
Satya

From: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Date: Saturday, 7 November 2015 6:48 am
To: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Cc: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: [radext] New Draft for RADIUS Extended Identifier Attribute

Hi All,

We have proposed a new draft for Extended Identifier Attribute.

Name:                 draft-aravind-radext-extended-identifier-attribute

Revision:            00

Title:                    RADIUS Extended Identifier Attribute

Document date:              2015-11-07

Group:                Individual Submission

Pages:                 6

URL:            https://www.ietf.org/internet-drafts/draft-aravind-radext-extended-identifier-attribute-00.txt

Status:         https://datatracker.ietf.org/doc/draft-aravind-radext-extended-identifier-attribute/

Htmlized:       https://tools.ietf.org/html/draft-aravind-radext-extended-identifier-attribute-00

Abstract:

   This document proposes solution to alleviate the limitation of

   limited size (8 bits) of RADIUS Identifier field by proposing a new

   Extended Identifier attribute.

We would love to hear your reviews and comments.

Thanks,
S. Aravind Prasad

---

From: Alan DeKok <[email-masked]>
Date: Thu, 12 Nov 2015 15:12:42 -0500

It's easy to say "extend the identifier space."  It's hard to work through all of the use-cases, so that we're *sure* it works.

  Right now, the draft proposes an idea.  That's nice.  The idea has been discussed off and on for a long time.

  I suggest that the draft propose a *solution*.  Explain how the extended identifier will work in practice.  Where it works, where it doesn't work, and how to tell the two situations apart.

  Alan DeKok.

---

From: <[email-masked]>
Date: Tue, 17 Nov 2015 11:23:29 +0530

Hi Peter/Satyanarayana/Alan,

Thanks a lot for your review comments and sorry for the delay in response.

Hi Peter,

>> Have you thought about how compatibility would work with proxy servers?
>> RADIUS Client --> RADIUS Proxy A --> RADIUS Server
>> For example what happens in the scenario where Client and RADIUS Server support Extended identifier however Proxy A does not?
>> RADIUS Client sends an Access-Request containing Extended-Identifier to Proxy A.
>> Proxy A does not understand Extended-Identifier and forwards the entire Access-Request including Extended-Identifier to RADIUS Server.
>> RADIUS Server gets request and incorrectly processes Extended-Identifier as if it was generated by Proxy A even though it was generated by RADIUS Client and is completely invalid in the scope of
>> communication between Proxy A and RADIUS Server.

Here is the flow as per the proposal.

1.       RADIUS Client --> RADIUS Proxy A --> RADIUS Server

2.       RADIUS Client sends an Access-Request containing both ID (in the message) and External-Identifier attribute to Proxy A.

3.       Proxy A doesn't understand External-Identifier attribute and forwards the Access-Request to RADIUS Server.

4.       RADIUS server gets the request and responds back with same ID (in the message) and External-Identifier attribute. Please note that both the IDs are in the response.

a.       If RADIUS server doesn't understand External-Identifier attribute, then only the ID of message header will be in the response.

5.       Proxy A gets the response and send to Client.

6.       In case client needs to send subsequent Access-Request message, that also will have both ID and External-Identifier attribute with different values.

The proposal introduces External-Identifier attribute along with ID. If the Radius server has the External-Identifier attribute support, then we will get the benefit of extended ID length. Otherwise, will work like today.
We realize that there is a possibility of misinterpreting some of the terms that we used in the draft. We will correct in the subsequent version.

Hi Satyanarayana/Alan,

Thanks for your views and comments. We will comeback with results and solutions in sometime soon.

Thanks,
S. Aravind Prasad

-----Original Message-----
From: Alan DeKok [mailto:[email-masked]]
Sent: Friday, November 13, 2015 1:43 AM
To: Satyanarayana Danda (sdanda)
Cc: Sridharan, Aravind; [email-masked]; Sivarama, Sanal Kumar
Subject: Re: [radext] New Draft for RADIUS Extended Identifier Attribute

Alan DeKok.