Subject: [radext] #55: Disconnect-Request

From: "radext issue tracker" <[email-masked]>
Date: Sat, 10 Jul 2010 01:22:05 -0000

#55: Disconnect-Request
---------------------------------------+------------------------------------
 Reporter:  bernard_aboba@…            |       Owner:  aland@…                  
     Type:  enhancement                |      Status:  new                      
 Priority:  major                      |   Milestone:  milestone1               
Component:  design                     |     Version:  1.0                      
 Severity:  Submitted WG Document      |    Keywords:                           
---------------------------------------+------------------------------------
 Section 3.1

       * Provisioning of services is not possible within an
         Access-Reject;

 [BA] This should say "Access-Reject or Disconnect-Request;"

    As noted in [RFC5080] Section 2.6, the intent of an Access-Reject is
    to deny access to the requested service.  As a result, RADIUS does
    not allow the provisioning of services within an Access-Reject.
    Documents which include provisioning of services within an Access-
    Reject are inherently incompatible with RADIUS, and SHOULD be
    redesigned.

 [BA] Recommend adding a paragraph on Disconnect-Request after this one:

    As noted in [RFC5176] Section 3:

    A Disconnect-Request MUST contain only NAS and session identification
    attributes.  If other attributes are included in a Disconnect-
    Request, implementations MUST send a Disconnect-NAK; an Error-Cause
    Attribute with value "Unsupported Attribute" MAY be included.

    As a result, documents which include provisioning of services
    within a Disconnect-Request are inherently incompatible with RADIUS,
    and SHOULD be redesigned.

-- 
Ticket URL: <https://wiki.tools.ietf.org/wg/radext/trac/ticket/55>
radext <http://tools.ietf.org/radext/>

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://psg.com/lists/radiusext/>

---

From: "radext issue tracker" <[email-masked]>
Date: Sat, 10 Jul 2010 01:26:28 -0000

#55: Disconnect-Request

Comment(by bernard_aboba@…):

 Also in A.4:

       * Provisioning of service in an Access-Reject.  Such provisioning
         is not permitted, and MUST NOT be used.  If limited access needs
         to be provided, then an Access-Accept with appropriate
         authorizations can be used instead.

 Please add after this:

       * Provisioning of service in a Disconnect-Request.
         Such provisioning is not permitted, and MUST NOT be used.
         If limited access needs to be provided, then a CoA-Request
         with appropriate authorizations can be used instead.

-- 
Ticket URL: <https://wiki.tools.ietf.org/wg/radext/trac/ticket/55#comment:1>
radext <http://tools.ietf.org/radext/>

---

From: "radext issue tracker" <[email-masked]>
Date: Sat, 10 Jul 2010 01:29:27 -0000

#55: Disconnect-Request

 Just noticed the incompatibility between the language in Section 3.1
 (SHOULD be redesigned) and the language in A.4:  MUST NOT be used.  Given
 that this is a prohibition in RFC 2865 and 5176, I think that the SHOULD
 is inappropriate (e.g. needs to be stronger).

-- 
Ticket URL: <https://wiki.tools.ietf.org/wg/radext/trac/ticket/55#comment:2>
radext <http://tools.ietf.org/radext/>

---

From: "radext issue tracker" <[email-masked]>
Date: Sat, 17 Jul 2010 17:44:14 -0000

#55: Disconnect-Request

 Recommendation is to change the text as follows:

 Change:

 To:

     Documents which include provisioning of services within an Access-
     Reject or Disconnect-Request are inherently incompatible with RADIUS
     and need to be redesigned.

 for A.4, proposed text is:

     * Provisioning of service in an Access-Reject. Such provisioning is
 not permitted by RFC 2865. If limited access needs to be provided, then an
 Access-Accept with appropriate authorizations can be used instead.

     * Provisioning of service in a Disconnect-Request. Such provisioning
 is not permitted, by RFC 5176. If limited access needs to be provided,
 then a CoA-Request with appropriate authorizations can be used instead.

-- 
Ticket URL: <https://wiki.tools.ietf.org/wg/radext/trac/ticket/55#comment:3>
radext <http://tools.ietf.org/radext/>