Re: [Dime] Need to know the location of a roaming peer?

Hello

Mostly I agree your concern too. Please see one comment as below...

B.R.
Yungui Wang

> -----Original Message-----
> From: dime-bounces@ietf.org [mailto:dime-bounces@ietf.org] On 
> Behalf Of Sebastien Decugis
> Sent: Tuesday, November 17, 2009 1:22 PM
> To: dime@ietf.org
> Subject: [Dime] Need to know the location of a roaming peer?
> 
> Hello all,
> 
> During the last meeting (thanks Hannes and Jouni for the 
> minutes) there
> was a discussion about the need (or absence of need) to 
> notify the home
> domain when a peer changes its authenticator in a visited 
> domain. During
> the discussion on ERP, my understanding of the conclusion was that we
> should do the re-authentication locally when possible in the visited
> domain, without going back to home domain. 

> Then, in case new
> authorization attributes are needed, we have a separate exchange with
> the home realm to fetch these fresh authorization attributes, 
> after the authentication is performed.

As described In section 5.3 of RFC5296, the realm part of keyName-NAI is the
local (ER server's) domain name. How can the new NAS know that the
authorization attributes should be freshed to the home server? Does other
entity (e.g. the ER server) do? 

In addition, when the peer moves to the new NAS, the old NAS should delete
the original authentication session with the home server. In this way, is it
acceptable for home server without peer's authentication session while new
authorization session is freshed/reserved?

> 
> Later during the session, a remark on emergency services (related to
> Diameter Parameter Query draft if I am not mistaken) sent the question
> back on the table, highlighting that in some contexts we may want to
> query the home server for the current location of the user. I am
> wondering, if the peer can move without the home server being notified
> (we assume server-initiated messages are routed transparently to the
> correct recipient) then the design of such query mechanism will be
> affected and complexity added.
> 
> I would like to ask the list if there is strong concerns with "hiding"
> the current authenticator of a roaming user to the home server, the
> result being that the home realm only knows the current 
> location with a
> granularity of the realm (inter-realm handovers should still 
> have to go
> to the home realm, AFAIU).
> 
> PS: I am wondering, in the context of emergency services, if we are
> really interested by the authenticator or by the point of 
> attachment for
> the given peer, as I understand there is a difference in some 
> deployment
> schemes...
> 
> Thank you for any comment,
> 
> Best regards,
> Sebastien.
> 
> -- 
> Sebastien Decugis
> Research fellow
> Network Architecture Group
> NICT (nict.go.jp)
> 
> _______________________________________________
> DiME mailing list
> DiME@ietf.org
> https://www.ietf.org/mailman/listinfo/dime
> 