INTERNET DRAFT Pat R. Calhoun Category: Standards Track Sun Microsystems, Inc. Title: draft-calhoun-diameter-authent-05.txt William Bulley Date: February 1999 Merit Network, Inc. DIAMETER User Authentication Extensions Status of this Memo This document is an individual contribution for consideration by the AAA Working Group of the Internet Engineering Task Force. Comments should be submitted to the diameter@ipass.com mailing list. Distribution of this memo is unlimited. This document is an Internet-Draft and is in full conformance with all provisions of Section 10 of RFC2026. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note that other groups may also distribute working documents as Internet-Drafts. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." The list of current Internet-Drafts can be accessed at: http://www.ietf.org/ietf/1id-abstracts.txt The list of Internet-Draft Shadow Directories can be accessed at: http://www.ietf.org/shadow.html. Abstract DIAMETER is a Policy and AAA protocol which can be used for a variety of services. This document defines DIAMETER messages that are used for the authentication, authorization and accounting of users. A considerable amount of effort was put into the design of this protocol to ensure that an implementation could support both DIAMETER Calhoun, Bulley expires August 1999 [Page 1] INTERNET DRAFT February 1999 and RADIUS concurrently. Calhoun, Bulley expires August 1999 [Page 2] INTERNET DRAFT February 1999 Table of Contents 1.0 Introduction 1.1 Specification of Requirements 2.0 Command Codes 2.1 AA-Request 2.2 AA-Answer 2.3 AA-Challenge-Ind 3.0 DIAMETER AVPs 3.1 User-Name 3.2 User-Password 3.3 CHAP-Password 3.4 NAS-Port 3.5 Service-Type 3.6 Framed-Protocol 3.7 Framed-IP-Address 3.8 Framed-IP-Netmask 3.9 Framed-Routing 3.10 Filter-Id 3.11 Framed-MTU 3.12 Framed-Compression 3.13 Login-IP-Host 3.14 Login-Service 3.15 Login-TCP-Port 3.16 Reply-Message 3.17 Callback-Number 3.18 Callback-Id 3.19 Framed-Route 3.20 Framed-IPX-Network 3.21 Idle-Timeout 3.22 Called-Station-Id 3.23 Calling-Station-Id 3.24 Login-LAT-Service 3.25 Login-LAT-Node 3.26 Login-LAT-Group 3.27 Framed-AppleTalk-Link 3.28 Framed-AppleTalk-Network 3.29 Framed-AppleTalk-Zone 3.30 CHAP-Challenge 3.31 NAS-Port-Type 3.32 Port-Limit 3.33 Login-LAT-Port 3.34 Filter-Rule 3.35 Framed-Password-Policy 3.36 Table of Attributes 4.0 Protocol Definition 4.1 Feature Advertisement/Discovery 4.2 Authorization Procedure Calhoun, Bulley expires August 1999 [Page 3] INTERNET DRAFT February 1999 4.3 Integration with Resource-Management 4.4 RADIUS Proxies 4.5 DIAMETER Proxies 4.6 Domain Discovery 5.0 References 6.0 Acknowledgements 7.0 Authors' Addresses 1.0 Introduction This document describes the DIAMETER User Authentication Extensions that can be used for a variety of services including Dial-up users via NAS, WWW User Authentication, Firewall User Authentication[5][6]. This document describes Authentication/Authorization messages as well as a set of messages which allow DIAMETER hosts to bypass proxies. Since Most of the AVPs found in this document was copied from the RADIUS protocol[1], it is possible to have both RADIUS and DIAMETER servers read the same dictionary and users files. The backward compatibility that DIAMETER offers is intended to facilitate deployment. The Extension number for this draft is one (1). This value is used in the Extension-Id AVP as defined in [2]. 1.1 Specification of Requirements In this document, several words are used to signify the requirements of the specification. These words are often capitalized. MUST This word, or the adjective "required", means that the definition is an absolute requirement of the specification. MUST NOT This phrase means that the definition is an absolute prohibition of the specification. SHOULD This word, or the adjective "recommended", means that there may exist valid reasons in particular circumstances to ignore this item, but the full implications must be understood and carefully weighed before choosing a different course. MAY This word, or the adjective "optional", means that this item is one of an allowed set of alternatives. An Calhoun, Bulley expires August 1999 [Page 4] INTERNET DRAFT February 1999 implementation which does not include this option MUST be prepared to interoperate with another implementation which does include the option. 2.0 Command Codes This document defines the following DIAMETER Commands. All DIAMETER implementations supporting this extension MUST support all of the following commands: Command Name Command Code ----------------------------------- AA-Request 263 AA-Answer 264 AA-Challenge-Ind 265 2.1 AA-Request (AAR) Description The AA-Request message is used in order to request authentication and authorization for a given user. If Authentication is requested the User-Name attribute MUST be present. If only Authorization is required it is possible to authorize based on DNIS and ANI instead. However, it is not possible to authenticate using a User-Name AVP and later requesting authorization based on DNIS using the same Session-Id (although the inverse is legal). Note that the flag field MAY be used in this command in order to indicate that either Authentication-Only or Authorization-Only is required for the request. If the Authentication-Only bit is set the response MUST NOT include any authorization information. Both the Authenticate and Authorize bits MUST NOT be set at the same time. To ensure that a user is both authenticated and authorized, neither flag is set. The AA-Request message MUST include a unique Session-Id AVP. If The AA-Request is a result of a successful AA-Challenge-Ind the Session-Id MUST be identical to the one provided in the initial AA-Request. Message Format Section 3.36 contains a complete list of all valid AVPs for this Calhoun, Bulley expires August 1999 [Page 5] INTERNET DRAFT February 1999 message. ::= [] [] [] [] { || { || ::= [] [] [] [] [] [] { || [] [] [] [] [] { || [9] Sklower, Lloyd, McGregor, Carr, "The PPP Multilink Protocol (MP)", RFC 1717, November 1994. [10] Calhoun, Greene, "DIAMETER Resource Management Extension", draft-calhoun-diameter-res-mgmt-02.txt, Work in Progress, February 1999. [11] Calhoun, Zorn, Pan, "DIAMETER Framework", draft-calhoun-diameter-framework-01.txt, Work in Progress, December 1998. Calhoun, Bulley expires August 1999 [Page 52] INTERNET DRAFT February 1999 6.0 Acknowledgements The Author wishes to thank Carl Rigney since much of the text in the document was shamefully copied from [1] as well as the following people for their help in the development of this protocol: Nancy Greene, Ryan Moats 7.0 Authors' Addresses Questions about this memo can be directed to: Pat R. Calhoun Network and Security Research Center, Sun Labs Sun Microsystems, Inc. 15 Network Circle Menlo Park, California, 94025 USA Phone: 1-650-786-7733 Fax: 1-650-786-6445 E-mail: pcalhoun@eng.sun.com William Bulley Merit Network, Inc. 4251 Plymouth Road, Suite C Ann Arbor, Michigan, 48105-2785 USA Phone: 1-734-764-9993 Fax: 1-734-647-3185 E-mail: web@merit.edu Calhoun, Bulley expires August 1999 [Page 53]