Dynamic Authorization Proxying in the Remote Authentication Dial-In User Service (RADIUS) Protocol
RFC 8559

• Status
• IESG evaluation record
• IESG writeups
• Email expansions
• History

• Versions
• 00
• 01
• 02
• 03
• 04
• 05
• 06
• 07
• 08
• 09
• 10

Internet Engineering Task Force (IETF)                          A. DeKok
Request for Comments: 8559                                    FreeRADIUS
Updates: 5176, 5580                                          J. Korhonen
Category: Standards Track                                     April 2019
ISSN: 2070-1721

                 Dynamic Authorization Proxying in the
      Remote Authentication Dial-In User Service (RADIUS) Protocol

Abstract

   RFC 5176 defines Change-of-Authorization (CoA) and Disconnect Message
   (DM) behavior for RADIUS.  RFC 5176 also suggests that proxying these
   messages is possible, but it does not provide guidance as to how that
   is done.  This specification updates RFC 5176 to correct that
   omission for scenarios where networks use realm-based proxying as
   defined in RFC 7542.  This specification also updates RFC 5580 to
   allow the Operator-Name attribute in CoA-Request and Disconnect-
   Request packets.

Status of This Memo

   This is an Internet Standards Track document.

   This document is a product of the Internet Engineering Task Force
   (IETF).  It represents the consensus of the IETF community.  It has
   received public review and has been approved for publication by the
   Internet Engineering Steering Group (IESG).  Further information on
   Internet Standards is available in Section 2 of RFC 7841.

   Information about the current status of this document, any errata,
   and how to provide feedback on it may be obtained at
   https://www.rfc-editor.org/info/rfc8559.

DeKok & Korhonen             Standards Track                    [Page 1]
RFC 8559        Dynamic Authorization Proxying in RADIUS      April 2019

Copyright Notice

   Copyright (c) 2019 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (https://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.

Table of Contents

   1. Introduction ....................................................3
      1.1. Terminology ................................................4
      1.2. Requirements Language ......................................5
   2. Problem Statement ...............................................5
      2.1. Typical RADIUS Proxying ....................................5
      2.2. CoA Processing .............................................6
      2.3. Failure of CoA Proxying ....................................6
   3. How to Perform CoA Proxying .....................................7
      3.1. Changes to Access-Request and Accounting-Request Packets ...8
      3.2. Proxying of CoA-Request and Disconnect-Request Packets .....9
      3.3. Reception of CoA-Request and Disconnect-Request Packets ...10
      3.4. Operator-NAS-Identifier ...................................11
   4. Requirements ...................................................14
      4.1. Requirements on Home Servers ..............................14
      4.2. Requirements on Visited Networks ..........................14
      4.3. Requirements on Proxies ...................................14
           4.3.1. Security Requirements on Proxies ...................15
           4.3.2. Filtering Requirements on Proxies ..................16
   5. Functionality ..................................................17
      5.1. User Login ................................................17
      5.2. CoA Proxying ..............................................17
   6. Security Considerations ........................................18
      6.1. RADIUS Security and Proxies ...............................18
      6.2. Security of the Operator-NAS-Identifier Attribute .........19
   7. IANA Considerations ............................................20
   8. References .....................................................20
      8.1. Normative References ......................................20
      8.2. Informative References ....................................21
   Authors' Addresses ................................................21

DeKok & Korhonen             Standards Track                    [Page 2]
RFC 8559        Dynamic Authorization Proxying in RADIUS      April 2019

1.  Introduction

   RFC 5176 [RFC5176] defines Change-of-Authorization (CoA) and
   Disconnect Message (DM) behavior for RADIUS.  Section 3.1 of
   [RFC5176] suggests that proxying these messages is possible, but it
   does not provide guidance as to how that is done.  This omission
   means that in practice, proxying of CoA packets is impossible.