Subject: [dhcwg] Question about RADIUS Attribute sub-option

From: Amy <[email-masked]>
Date: Wed, 09 Aug 2006 13:46:05 +0800

Hi,all
     I'm reading RFC4014, and I can not understand the following sentences
in Section 4: DHCP Relay Agent behavior
    
    "To avoid dependencies between the address allocation and other state
   information between the RADIUS server and the DHCP server, the DHCP
   relay agent SHOULD include only the attributes in the table below in
   an instance of the RADIUS Attributes suboption."

  1) What does "other state information between the RADIUS server and the
DHCP Server" refer to?
  2) What does "the dependencies"' refer to?
  3) Why are the attributes that SHOULD include the RADIUS Attribute
sub-option confined to the attributes listed in the following table?

"           #   Attribute
         ---   ---------
           1   User-Name (RFC 2865 [3])
           6   Service-Type (RFC 2865)
          26   Vendor-Specific (RFC 2865)
          27   Session-Timeout (RFC 2865)
          88   Framed-Pool (RFC 2869)
         100   Framed-IPv6-Pool (RFC 3162 [7])
"

Thank you!

Best Regards!

Amy

_______________________________________________
dhcwg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dhcwg

---

From: John Schnizlein <[email-masked]>
Date: Wed, 9 Aug 2006 11:05:59 -0400

All good questions.

This constraint was what the RADIUS-doctors and the IESG said was 
appropriate.  The essential concern was to avoid having to coordinate 
state information between a RADIUS server and a DHCP server.

John

---

From: Amy <[email-masked]>
Date: Fri, 11 Aug 2006 09:42:59 +0800

Thank you!

I don' know if I catch your mean.

During the lifetime of  a session, some of the RADIUS attributes are not
stable. If we pass these attributes to DHCP Server, we must coordinate state
information between a RADIUS Server and a DHCP server, and there is no such
mechanism now.

Right?

Best Regards!

Amy

> -----Original Message-----
> From: John Schnizlein [mailto:[email-masked]] 
> Sent: Wednesday, August 09, 2006 11:06 PM
> To: Amy
> Cc: [email-masked]
> Subject: Re: [dhcwg] Question about RADIUS Attribute sub-option
> 
> All good questions.
> 
> This constraint was what the RADIUS-doctors and the IESG said 
> was appropriate.  The essential concern was to avoid having 
> to coordinate state information between a RADIUS server and a 
> DHCP server.
> 
> John
> 
> >      I'm reading RFC4014, and I can not understand the following 
> > sentences in Section 4: DHCP Relay Agent behavior
> >
> >   1) What does "other state information between the RADIUS 
> server and 
> > the DHCP Server" refer to?

---

From: John Schnizlein <[email-masked]>
Date: Fri, 11 Aug 2006 10:17:15 -0400

> I don' know if I catch your mean.

I don't pretend to understand why the RADIUS-doctors and the IESG were 
so concerned.

> information between a RADIUS Server and a DHCP server, and there is no 

I never heard the concern specified in as much detail as you have here 
- so not quite right.

Our goal was to enable the allocation of addresses and other host 
options to depend on the network access policy provided by RADIUS (even 
when PPP is not present to deliver this information to the host 
authorized for access.  We thought it reasonable that administrative 
coordination of which RADIUS attributes would produce which DHCP 
options would be a matter of local policy, and had no constraints on 
what could be relayed.  Despite the implication that the RADIUS 
protocol is stateless*, after the IETF last call, we were informed that 
the document that would become RFC 4014 would not advance until 
concerns of the RADIUS-doctors were resolved.  The list that satisfied 
the RADIUS-doctors is what was included in RFC 4014.

John

* RFC 2865 page 11
    3. The stateless nature of this protocol simplifies the use of UDP.

>>>     "To avoid dependencies between the address allocation and other
>>>    state information between the RADIUS server and the DHCP
>>>    server, the DHCP relay agent SHOULD include only the attributes 
>>> in the
>>>    table below in an instance of the RADIUS Attributes suboption."
>>>
>>> server and the DHCP Server" refer to?