[Dime] Question on realm validity in answer messages

[Marco Stura <[e-mail]>]

Dear all,

I'm facing the following situation.

|---------------------------- SPrealm--------------------------------------------------|

                                                                                   _----------- Server 1(realm a)
                                                                                _
                                                                             _
Client ------------------ Proxy(SPrealm) ---------------- Server 2(realm b)
                                                                            _
                                                                                _
                                                                                   _
                                                                                       ---------- Sever 3 (realm c)


The implementation is such that the Proxy is load balancing by selecting the internal Server where the subscriber data are provisioned, based on user identity.
The Client is sending an application specific authorization request to the Proxy for NAI user@SPrealm, Destination-Realm == SPrealm.
The Proxy selects e.g. Server 2 based on user@SPrealm and send the request there changing the Destination-Realm to realm b.
Server 2 processes the request generates an answer and send it to the Proxy with Origin-Host == server2@realm b, Origin-Realm == realm b.
The Proxy forward the answer to the Client, that receives a successful authorization answer from a realm that is different from the one supposed to serve the user (as in the NAI).
The client terminates the session with STR to Destination-Host == server2@realm b, Destination-Realm == realm b, Termination-Cause == Diameter_bad_answer

The Proxy and the Servers are part of the same implementation, which apparently requires this kind of configuration to work.
In RFC 6733 (or RFC 3388) it is not explicitly stated how to deal with cases where a successful authorization answer is coming from a server located in a different realm than the home realm of the user (as per NAI).
However, to say the least, this configuration is quite bizarre and the client IMHO is right to terminate the session as this behavior may looks to the client like an answer from a malicious node. But I don't remember any discussion on this aspects back at the Diameter protocol development time.....

Any opinion on this scenario?

BR,
Marco





________________________________

The information in this email and any attachments thereto may contain information that is confidential, protected by intellectual property rights, and may be legally privileged. It is intended solely for the addressee(s). Access to this email by anyone else is unauthorized. Any use, disclosure, copying, or distribution of the information contained herein by persons other than the designated addressee is unauthorized and may be unlawful. If you are not the intended recipient, you should delete the message immediately from your system. If you believe that you have received this email in error, please contact the sender. Any views expressed in this email and its attachments are those of the individual sender except where the sender expressly states them to be the views of Ooredoo.