[radext] #170: Allowed-Called-Station-Id usage scenarios

["radext issue tracker" <[e-mail]>]

#170: Allowed-Called-Station-Id usage scenarios

 Section 2.1 currently lists three potential usage scenarios for the
 Allowed-Called-Station-Id attribute.  However, of the three scenarios, the
 most compelling ones relate to wireless.  Narrowing the focus to a single
 usage scenario would improve the clarity of the section.

 The following text is proposed for Section 2.1:

 2.1.  Allowed-Called-Station-Id

    Description

       The Allowed-Called-Station-Id Attribute allows the RADIUS server
       to specify the authenticator MAC addresses and/or networks to
       which the user is allowed to connect.  One or more Allowed-Called-
       Station-Id attributes MAY be included in an Access-Accept or CoA-
       Request packet.

       The Allowed-Called-Station-Id Attribute can be useful in
       situations where pre-authentication is supported (e.g.  IEEE
       802.11 pre-authentication).  In these scenarios, the network name
       typically will not be included in a Called-Station-Id Attribute
       within the Access-Request and the RADIUS server will not know the
       network that the user is attempting to access.  The Allowed-
       Called-Station-Id enables the RADIUS server to restrict the
       networks and attachment points to which the user can subsequently
       connect.

       A summary of the Allowed-Called-Station-Id Attribute format is
       shown below.  The fields are transmitted from left to right.

        0                   1                   2                   3
        0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |     Type      |  Length       |            String...
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

    Code

       TBD1

    Length

       >=3

    String

       The String field is one or more octets, specifying a Called-
       Station-Id that the user may utilize as a point of attachment.  If
       the user attempts to connect to the Network Authentication Server
       (NAS) from a Called-Station-Id that does not match one of the
       Allowed-Called-Station-Id attributes, then the NAS MUST NOT permit
       the user to access the network.

       In the case of IEEE 802, the Allowed-Called-Station-Id Attribute
       is used to store the Medium Access Control (MAC) address in ASCII
       format (upper case only), with octet values separated by a "-".
       Example: "00-10-A4-23-19-C0".  Where restrictions on both the
       network and authenticator MAC address usage are intended, the
       network name MUST be appended to the authenticator MAC address,
       separated from the MAC address with a ":".  Example:
       "00-10-A4-23-19-C0:AP1".  Where no MAC address restriction is
       intended, the MAC address field MUST be omitted, but ":" and the
       network name field MUST be included.  Example: ":AP1".

       Within IEEE 802.11 [IEEE-802.11], the SSID constitutes the network
       name; within IEEE 802.1X [IEEE-802.1X], the Network-Id Name (NID-
       Name) constitutes the network name.  Since a NID-Name can be up to
       253 octets in length, when used with [IEEE-802.1X], there may not
       be sufficient room within the Allowed-Called-Station-Id Attribute
       to include both a MAC address and a Network Name.  However, since
       the Allowed-Called-Station-Id Attribute is expected to be used
       largely in wireless access scenarios, this restriction is not
       considered serious.

-- 
-------------------------------------+-------------------------------------
 Reporter:                           |      Owner:  draft-ietf-radext-
  [e-mail]          |  [e-mail]
     Type:  defect                   |     Status:  new
 Priority:  minor                    |  Milestone:  milestone1
Component:  ieee802ext               |    Version:  1.0
 Severity:  In WG Last Call          |   Keywords:
-------------------------------------+-------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/radext/trac/ticket/170>
radext <http://tools.ietf.org/radext/>