Re: [Dime] RAR Message with possible ReAuth-Request_type

Hi Glen,

Thanks and appreciate your quick response!

I would like to just validate the user credentials (Authentication) and not expecting any profile to be downloaded.

I am looking for a use-case like this.

1. Authorization Request from NAS with the MAC Address (supposed to be failed)
2. Apply HTTP Redirect on the NAS, so that subscriber will be redirected to a portal upon first ip traffic seen
3.  Subscriber will be prompted for credentials via web login page
4. Portal/Diameter Server pushes RA-R to NAS with the subscriber credentials
5. NAS would send AA-R just to validate the credentials, not expecting any profile to be downloaded as part of this.
	(Just credential validation - Authentication only)
6. Upon Successful authentication, NAS sends CCR-I to PCRF to download the policy information.
	(This is real authorization step)

Thanks
Satya

-----Original Message-----
From: Glen Zorn [mailto:glenzorn@gmail.com] 
Sent: Saturday, November 23, 2013 1:57 PM
To: Satyanarayana Danda (sdanda)
Cc: dime@ietf.org; glenzorn@gmail.com
Subject: Re: [Dime] RAR Message with possible ReAuth-Reqiest_type

On 11/23/2013 03:06 PM, Satyanarayana Danda (sdanda) wrote:

> Hi folks,
>
> I am looking for a case where *Re-Auth-Request* is sent to NAS with 
> subscriber credentials captured via web Portal (web-logon) case.
>
>  From RFC 6733, we do have two options set in *ReAuth-Request-Type* 
> AVP of the action expected. From my use-case standpoint, I would like 
> to inform
>
> NAS to take *AUTHENTICATE_ONLY* action by sending AA-Request for 
> credential validation.
>
> Since this is not specified as part of this RFC, do you see this needs 
> to be addressed?
>
> Please let me know in case you want more details on the use-case.

I would like more details.  In particular, why do you believe that authorization in unnecessary?

>
> Thanks
>
> Satya
>
>
>       <snip>
>
>
>       Re-Auth-Request-Type AVP
>
>
>
>     The Re-Auth-Request-Type AVP (AVP Code 285) is of type Enumerated 
> and
>
>     is included in application-specific auth answers to inform the 
> client
>
>     of the action expected upon expiration of the Authorization-Lifetime.
>
>
>
>     If the answer message contains an Authorization-Lifetime AVP with 
> a
>
>     positive value, the Re-Auth-Request-Type AVP MUST be present in an
>
>     answer message.  The following values are defined:
>
>
>
>     AUTHORIZE_ONLY 0
>
>
>
>        An authorization only re-auth is expected upon expiration of 
> the
>
>        Authorization-Lifetime.  This is the default value if the AVP 
> is
>
>        not present in answer messages that include the Authorization-
>
>        Lifetime.
>
>
>
>     AUTHORIZE_AUTHENTICATE 1
>
>
>
>        An authentication and authorization re-auth is expected upon
>
>        expiration of the Authorization-Lifetime.
>
> </snip>
>
>
>
> _______________________________________________
> DiME mailing list
> DiME@ietf.org
> https://www.ietf.org/mailman/listinfo/dime
>