Subject: (radius) Acct-Session-Id in Access-Requests

From: Carl Rigney <[email-masked]>
Date: Wed, 4 Nov 1998 04:21:51 -0800 (PST)

Possibly I'm mellowing in my dotage, but as I'm looking over the
attribute tables for the revised drafts I recall that once upon a time
people asked about the possibility of allowing NASes to send
Acct-Session-Id in their Access-Request, so that such requests could be
linked up later with the matching accounting record.  At the time it
seemed marginal, but in the Brave New World of Proxy it seems more
useful.

Would there be a firestorm of protest if Acct-Session-Id were permitted
in Access-Request as well as Accounting-Requests?

--
Carl Rigney
RADIUS WG Editor
[email-masked]
-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.

---

From: Wei Wang <[email-masked]>
Date: Wed, 04 Nov 1998 14:24:34 +0000

> in Access-Request as well as Accounting-Requests?

I'd say that's great, especially as you said in the world of proxy.
But there should be some provision on making the Acct-Session-Id's
unique across NAS'es without having to do any trick with its content
on the server side. Otherwise, it would be difficult to use the
Acct-Session-Id's in a generalized way. Since NAS-IP-Address and
NAS-Identifier are defined as "SHOULD" be in access requests, life
would much easier if one can depend on the Acct-Session-Id to be
unique.

Regards,
--
Wei Wang               [email-masked]
Merit Network, Inc.    http://www-personal.umich.edu/~weiwang/
[Tel] 734-764-2874     [Fax] 734-647-3745
-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.

---

From: Aydin Edguer <[email-masked]>
Date: Wed, 4 Nov 1998 10:36:15 -0500 (EST)

Wei Wang wrote:
> on the server side.

I have no objection to allowing the Acct-Session-Id in an Access-Request.
In fact, some NAS vendors are already putting it there, so it makes sense
to allow it.

I would have an objection to trying to force the Acct-Session-Id to be
unique across NAS'es.  In my opinion, it would not help, since you have
no guarantee in a roaming situation that the originating NAS will have
this feature/capability.  Further, how is a NAS supposed to guarantee
this?  Requiring the owner/operator to configure something on the NAS 
is not going to guarantee it.
-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.

---

From: MARC DE VRIES WE41/KT <[email-masked]>
Date: Thu, 05 Nov 1998 13:19:03 +0200 (MET-DST)

Having worked on a RADIUS proxy for some time now, I'd say a session-id in
Access-Request is a MUST, but I can live with SHOULD... Advantages in keeping
session state are obvious. There are work-arounds now (NAS-Id, NAS-Port,
User-Name combos) but only the session-id really does the trick.

I would like to remark that the DIAMETER protocol (possible successor for
RADIUS??) requires a session-id in all requests as it is <really>
session-oriented.

As for the global uniqueness of session-ids: I fail to see the reason for that,
at least on the NAS level. The first proxy communicating with the NAS can
distinguish the NASes (by source IP or attribute 4 or 32). If it also has the
session-id, it can 'combine' them to form a system-unique session-id when
forwarding the requests. If further down the line, a RADIUS server receives
requests from multiple proxy servers and NASses, it can use the same logic to
come up with it's own system-unique IDs.

Regards,

Marc

-

---

From: Victor Muslin <[email-masked]>
Date: Fri, 06 Nov 1998 00:46:38 -0500

I would strongly encourage allowing Acct-Session-Id in Access-Request. It's
a needed feature for the servers that keep session state.

>in Access-Request as well as Accounting-Requests?
_______________________________________________________________________
Victor Muslin

-