Subject: [Geopriv] Radius-Geopriv: When to send location info?

From: Tschofenig Hannes <[email-masked]>
Date: Wed, 2 Mar 2005 11:21:55 +0100

hi all, 

please take a look at the following issue raised by lionel and bernard:

[Lionel:]

- It is not described whether this location information will be included in
every access-request  or only when some criteria are met e.g. based on a
given realm. It'd be intersting to spell out  these criteria. 
- If the use of location info in access-request could be optional, a COA
explicitly requesting  this info (when not received in the initial
access-request) could be used by the Home RADIUS  server.

How does the AAA server instruct the access network to send location
information attributes within  the new Access-Request? Is there any specific
attribute in the COA indicating that the location  information is requested?
Or do you assume that any Access-Request sent by the NAS will contain  the
location information attribute and so case 1 and 2 are the same?

[Bernard:]

RFC 3576 does not use attributes in the CoA-Request in order to request
attributes in a subsequent  Access-Request.  Nor does it make sense to
include location attributes in a CoA-Request.  The  session to which the CoA
applies is not selected using location attributes, nor is the request  that
the NAS change its location -- "Please move NAS17483 to Cleveland, Ohio."

[Avi]
I agree with Bernard, and we don't send location attributes to the NAS in
COA Request.

I think that the text is confusing:

   "The COA message may instruct the access
   network to generate an Authorize-Only Access-Request (Access-Request
   with Service-Type set to "Authorize-Only") in which case it is
   instructing the access network to send the location information
   attributes."

May be we should say:

   "The COA message may instruct the access
   network to generate an Authorize-Only Access-Request (Access-Request
   with Service-Type set to "Authorize-Only") in which case the NAS 
   MUST include the location infromation in this Access-Request."
 
[Bernard:]

Is there a way for the AAA server to indicate to the access network that the
request failed  because the location information is missing?

[Lionel:]

See RFC 3576 Error-Cause attribute, value 402 (Missing Attribute)

[Avi]

I don't think that we can use the Error-Cause attribute.  It is only
available in COA ACK/NAK  messages. So the AAA has no way to tell the NAS
that it is missing the location attribute. I don't  think that this
attribute can be placed in an Access-Reject message.
What do you think Bernard? 

[hannes] to me it seems reasonable not to include location information with
every request. a  visited network which knows that it has to send location
information to a particular home network  might do so. i also think that it
would be good to have an error attribute to indicate that it was  not
possible to authorize the user properly based on the missing location
information. 

we have added the usage of the error-cause attribute. within the iana
section we need to register  a new type:

"
15.2  Error-Cause Attribute

   The authors also request that IANA assign a new value for the
   Error-Cause attribute [5], of "Location-Info-Required" TBA.
"

minor text adjustments can be found within the recent draft version. 

ciao
hannes

_______________________________________________
Geopriv mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/geopriv

---

From: Bernard Aboba <[email-masked]>
Date: Wed, 2 Mar 2005 05:52:17 -0800 (PST)

> section we need to register  a new type:

I am confused by the model that is described here.  I could understand why
the NAS might not send the NAS location with every Access-Request.  But
user location is another matter.  If the NAS is set up to send user
location data, why would it not send it on each request?

My reading of RFC 2865 is that service provisioning attributes (including
VSAs) are forbidden in a RADIUS Access-Reject.  However, information on
why the request failed is ok (e.g. Reply-Message, EAP-Message/EAP-Failure,
etc.).  So I think that Error-Cause can be included.

However, Error-Cause will not solve the problem that is described.  If the
NAS is not sending User location on every Access-Request and the server
requires this, then every Access-Request that is sent without the user
location will be denied.

I'd suggest that language be included in the document to say that "by
default, a NAS that is set up to provide user location information to the
RADIUS server MUST provide this information in every Access-Request."

---

From: Jari Arkko <[email-masked]>
Date: Thu, 03 Mar 2005 22:09:24 +0200

>RADIUS server MUST provide this information in every Access-Request."

Yes. I would in fact extend this by having the NAS send this
information in the first place if and only if the home AAA
earlier instructed the NAS to do so for this specific session.
The cost would be very small, no additional roundtrips for
instance.

--Jari

---

From: Jari Arkko <[email-masked]>
Date: Fri, 04 Mar 2005 14:56:39 +0200

>RADIUS server MUST provide this information in every Access-Request."
Or even skip "by default" and agree that where user location
information (a) can be delivered and (b) is policy-wise desired to be
sent at all, it is always sent.

For NAS location you could send it only if it has changed (e.g.
mobile router).

--Jari