Dynamic Authorization Proxying in the Remote Authentication Dial-In User Service (RADIUS) Protocol
RFC 8559
Document | Type | RFC - Proposed Standard (April 2019; No errata) | |
---|---|---|---|
Authors | Alan DeKok , Jouni Korhonen | ||
Last updated | 2019-04-09 | ||
Replaces | draft-dekok-radext-coa-proxy | ||
Stream | Internent Engineering Task Force (IETF) | ||
Formats | plain text html pdf htmlized (tools) htmlized bibtex | ||
Reviews | |||
Stream | WG state | Submitted to IESG for Publication | |
Document shepherd | Stefan Winter | ||
Shepherd write-up | Show (last changed 2018-04-24) | ||
IESG | IESG state | RFC 8559 (Proposed Standard) | |
Action Holders |
(None)
|
||
Consensus Boilerplate | Yes | ||
Telechat date | |||
Responsible AD | Benjamin Kaduk | ||
Send notices to | Stefan Winter <stefan.winter@restena.lu> | ||
IANA | IANA review state | Version Changed - Review Needed | |
IANA action state | RFC-Ed-Ack |
Internet Engineering Task Force (IETF) A. DeKok Request for Comments: 8559 FreeRADIUS Updates: 5176, 5580 J. Korhonen Category: Standards Track April 2019 ISSN: 2070-1721 Dynamic Authorization Proxying in the Remote Authentication Dial-In User Service (RADIUS) Protocol Abstract RFC 5176 defines Change-of-Authorization (CoA) and Disconnect Message (DM) behavior for RADIUS. RFC 5176 also suggests that proxying these messages is possible, but it does not provide guidance as to how that is done. This specification updates RFC 5176 to correct that omission for scenarios where networks use realm-based proxying as defined in RFC 7542. This specification also updates RFC 5580 to allow the Operator-Name attribute in CoA-Request and Disconnect- Request packets. Status of This Memo This is an Internet Standards Track document. This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Further information on Internet Standards is available in Section 2 of RFC 7841. Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at https://www.rfc-editor.org/info/rfc8559. DeKok & Korhonen Standards Track [Page 1] RFC 8559 Dynamic Authorization Proxying in RADIUS April 2019 Copyright Notice Copyright (c) 2019 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Table of Contents 1. Introduction ....................................................3 1.1. Terminology ................................................4 1.2. Requirements Language ......................................5 2. Problem Statement ...............................................5 2.1. Typical RADIUS Proxying ....................................5 2.2. CoA Processing .............................................6 2.3. Failure of CoA Proxying ....................................6 3. How to Perform CoA Proxying .....................................7 3.1. Changes to Access-Request and Accounting-Request Packets ...8 3.2. Proxying of CoA-Request and Disconnect-Request Packets .....9 3.3. Reception of CoA-Request and Disconnect-Request Packets ...10 3.4. Operator-NAS-Identifier ...................................11 4. Requirements ...................................................14 4.1. Requirements on Home Servers ..............................14 4.2. Requirements on Visited Networks ..........................14 4.3. Requirements on Proxies ...................................14 4.3.1. Security Requirements on Proxies ...................15 4.3.2. Filtering Requirements on Proxies ..................16 5. Functionality ..................................................17 5.1. User Login ................................................17 5.2. CoA Proxying ..............................................17 6. Security Considerations ........................................18 6.1. RADIUS Security and Proxies ...............................18 6.2. Security of the Operator-NAS-Identifier Attribute .........19 7. IANA Considerations ............................................20 8. References .....................................................20 8.1. Normative References ......................................20 8.2. Informative References ....................................21 Authors' Addresses ................................................21 DeKok & Korhonen Standards Track [Page 2] RFC 8559 Dynamic Authorization Proxying in RADIUS April 2019 1. Introduction RFC 5176 [RFC5176] defines Change-of-Authorization (CoA) and Disconnect Message (DM) behavior for RADIUS. Section 3.1 of [RFC5176] suggests that proxying these messages is possible, but it does not provide guidance as to how that is done. This omission means that in practice, proxying of CoA packets is impossible.Show full document text