Subject: [Geopriv] AW: AW: Review of draft-ietf-geopriv-radius-lo-04.txt

From: "Tschofenig, Hannes" <[email-masked]>
Date: Sun, 4 Sep 2005 16:46:27 +0200

hi bernard, 

> > The radius server might also understand either civic, 
> geospatial or  both. 
> 
> We need to distinguish between the RADIUS Accounting Server 
> and the RADIUS 
> Authentication Server.  The RADIUS Accounting Server can be 
> assumed to 
> "understand" anything (e.g. it just writes AVPs to stable 
> storage).  The 
> RADIUS Server should be thought of as either REQUIRING or NOT 
> REQUIRING an 
> attribute.  If an attribute is REQUIRED the RADIUS Server 
> will request it 
> in an Access-Challenge.  

if we talk about location-based authorization and if this authorization
step is mandatory then the radius server will ask the nas to provide
location information and if he cannot provide it then an access reject
must be sent. 

if the home network operator just wants to print location information to
the bill (something like 'wlan hotspot at abc in munich') then the
radius server might not want to send an access reject if the nas cannot
provide it. maybe the best way to address this aspect is not to request
location information with the access-challenge but later when accounting
messages are exchanged. 

ciao
hannes

_______________________________________________
Geopriv mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/geopriv

---

From: Bernard Aboba <[email-masked]>
Date: Sun, 4 Sep 2005 14:03:52 -0700 (PDT)

> location information and if he cannot provide it then an access reject

Right. 

> location information with the access-challenge but later when accounting

If the RADIUS server needs location info for authorization then it needs 
to send an Access-Challenge expressing that need.  If does not require 
location information in the Access-Request but would like it in the 
Accounting packets if available, it can include a "send location" 
attribute in an Access-Accept. 

Summary:

a. RADIUS Server REQUIRES location in Access-Request or 
Accounting-Request:  server sends an Access-Challenge with an attribute 
that expresses what is required. 

b. RADIUS server would like location information in the Accounting-Request 
but does not require it:  RADIUS server sends an Access-Accept with an 
attribute that expresses what is desired. 

c. RADIUS server REQUIRES location in Access-Request, but has not received 
it after sending an Access-Challenge:  RADIUS server 
sends an Access-Reject with an Error-Cause attribute with value "Missing 
Location Information"