Subject: [radext] #170: Allowed-Called-Station-Id usage scenarios

From: "radext issue tracker" <[email-masked]>
Date: Sun, 20 Oct 2013 20:57:43 -0000

#170: Allowed-Called-Station-Id usage scenarios

 Section 2.1 currently lists three potential usage scenarios for the
 Allowed-Called-Station-Id attribute.  However, of the three scenarios, the
 most compelling ones relate to wireless.  Narrowing the focus to a single
 usage scenario would improve the clarity of the section.

 The following text is proposed for Section 2.1:

 2.1.  Allowed-Called-Station-Id

    Description

       The Allowed-Called-Station-Id Attribute allows the RADIUS server
       to specify the authenticator MAC addresses and/or networks to
       which the user is allowed to connect.  One or more Allowed-Called-
       Station-Id attributes MAY be included in an Access-Accept or CoA-
       Request packet.

       The Allowed-Called-Station-Id Attribute can be useful in
       situations where pre-authentication is supported (e.g.  IEEE
       802.11 pre-authentication).  In these scenarios, the network name
       typically will not be included in a Called-Station-Id Attribute
       within the Access-Request and the RADIUS server will not know the
       network that the user is attempting to access.  The Allowed-
       Called-Station-Id enables the RADIUS server to restrict the
       networks and attachment points to which the user can subsequently
       connect.

       A summary of the Allowed-Called-Station-Id Attribute format is
       shown below.  The fields are transmitted from left to right.

        0                   1                   2                   3
        0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |     Type      |  Length       |            String...
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

    Code

       TBD1

    Length

       >=3

    String

       The String field is one or more octets, specifying a Called-
       Station-Id that the user may utilize as a point of attachment.  If
       the user attempts to connect to the Network Authentication Server
       (NAS) from a Called-Station-Id that does not match one of the
       Allowed-Called-Station-Id attributes, then the NAS MUST NOT permit
       the user to access the network.

       In the case of IEEE 802, the Allowed-Called-Station-Id Attribute
       is used to store the Medium Access Control (MAC) address in ASCII
       format (upper case only), with octet values separated by a "-".
       Example: "00-10-A4-23-19-C0".  Where restrictions on both the
       network and authenticator MAC address usage are intended, the
       network name MUST be appended to the authenticator MAC address,
       separated from the MAC address with a ":".  Example:
       "00-10-A4-23-19-C0:AP1".  Where no MAC address restriction is
       intended, the MAC address field MUST be omitted, but ":" and the
       network name field MUST be included.  Example: ":AP1".

       Within IEEE 802.11 [IEEE-802.11], the SSID constitutes the network
       name; within IEEE 802.1X [IEEE-802.1X], the Network-Id Name (NID-
       Name) constitutes the network name.  Since a NID-Name can be up to
       253 octets in length, when used with [IEEE-802.1X], there may not
       be sufficient room within the Allowed-Called-Station-Id Attribute
       to include both a MAC address and a Network Name.  However, since
       the Allowed-Called-Station-Id Attribute is expected to be used
       largely in wireless access scenarios, this restriction is not
       considered serious.

-- 
-------------------------------------+-------------------------------------
 Reporter:                           |      Owner:  draft-ietf-radext-
  [email-masked]          |  [email-masked]
     Type:  defect                   |     Status:  new
 Priority:  minor                    |  Milestone:  milestone1
Component:  ieee802ext               |    Version:  1.0
 Severity:  In WG Last Call          |   Keywords:
-------------------------------------+-------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/radext/trac/ticket/170>
radext <http://tools.ietf.org/radext/>

---

From: "radext issue tracker" <[email-masked]>
Date: Sun, 20 Oct 2013 21:32:41 -0000

Comment (by [email-masked]):

 Some clean up of the proposed text for Section 2.1:

    Description

       The Allowed-Called-Station-Id Attribute allows the RADIUS server
       to specify the authenticator MAC addresses and/or networks to
       which the user is allowed to connect.  One or more Allowed-Called-
       Station-Id attributes MAY be included in an Access-Accept, CoA-
       Request or Accounting-Request packet.

       The Allowed-Called-Station-Id Attribute can be useful in
       situations where pre-authentication is supported (e.g.  IEEE
       802.11 pre-authentication).  In these scenarios, a Called-Station-
       Id Attribute typically will not be included within the Access-
       Request so that the RADIUS server will not know the network that
       the user is attempting to access.  The Allowed-Called-Station-Id
       enables the RADIUS server to restrict the networks and attachment
       points to which the user can subsequently connect.

        0                   1                   2                   3

    Code

       TBD1

    Length

    String

       The String field is one or more octets, specifying a Called-
       Station-Id that the user MAY connect to; if the Called-Station-Id
       that the user connects to does not match one of the Allowed-
       Called-Station-Id Attributes, the Network Authentication Server
       (NAS) MUST NOT permit the user to access the network.

 Severity:  In WG Last Call          |  Resolution:
 Keywords:                           |

Ticket URL: <http://trac.tools.ietf.org/wg/radext/trac/ticket/170#comment:1>
radext <http://tools.ietf.org/radext/>