Dynamic Authorization Proxying in the Remote Authentication Dial-In User Service (RADIUS) Protocol
RFC 8559
Internet Engineering Task Force (IETF) A. DeKok
Request for Comments: 8559 FreeRADIUS
Updates: 5176, 5580 J. Korhonen
Category: Standards Track April 2019
ISSN: 2070-1721
Dynamic Authorization Proxying in the
Remote Authentication Dial-In User Service (RADIUS) Protocol
Abstract
RFC 5176 defines Change-of-Authorization (CoA) and Disconnect Message
(DM) behavior for RADIUS. RFC 5176 also suggests that proxying these
messages is possible, but it does not provide guidance as to how that
is done. This specification updates RFC 5176 to correct that
omission for scenarios where networks use realm-based proxying as
defined in RFC 7542. This specification also updates RFC 5580 to
allow the Operator-Name attribute in CoA-Request and Disconnect-
Request packets.
Status of This Memo
This is an Internet Standards Track document.
This document is a product of the Internet Engineering Task Force
(IETF). It represents the consensus of the IETF community. It has
received public review and has been approved for publication by the
Internet Engineering Steering Group (IESG). Further information on
Internet Standards is available in Section 2 of RFC 7841.
Information about the current status of this document, any errata,
and how to provide feedback on it may be obtained at
https://www.rfc-editor.org/info/rfc8559.
DeKok & Korhonen Standards Track [Page 1]
RFC 8559 Dynamic Authorization Proxying in RADIUS April 2019
Copyright Notice
Copyright (c) 2019 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(https://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
Table of Contents
1. Introduction ....................................................3
1.1. Terminology ................................................4
1.2. Requirements Language ......................................5
2. Problem Statement ...............................................5
2.1. Typical RADIUS Proxying ....................................5
2.2. CoA Processing .............................................6
2.3. Failure of CoA Proxying ....................................6
3. How to Perform CoA Proxying .....................................7
3.1. Changes to Access-Request and Accounting-Request Packets ...8
3.2. Proxying of CoA-Request and Disconnect-Request Packets .....9
3.3. Reception of CoA-Request and Disconnect-Request Packets ...10
3.4. Operator-NAS-Identifier ...................................11
4. Requirements ...................................................14
4.1. Requirements on Home Servers ..............................14
4.2. Requirements on Visited Networks ..........................14
4.3. Requirements on Proxies ...................................14
4.3.1. Security Requirements on Proxies ...................15
4.3.2. Filtering Requirements on Proxies ..................16
5. Functionality ..................................................17
5.1. User Login ................................................17
5.2. CoA Proxying ..............................................17
6. Security Considerations ........................................18
6.1. RADIUS Security and Proxies ...............................18
6.2. Security of the Operator-NAS-Identifier Attribute .........19
7. IANA Considerations ............................................20
8. References .....................................................20
8.1. Normative References ......................................20
8.2. Informative References ....................................21
Authors' Addresses ................................................21
DeKok & Korhonen Standards Track [Page 2]
RFC 8559 Dynamic Authorization Proxying in RADIUS April 2019
1. Introduction
RFC 5176 [RFC5176] defines Change-of-Authorization (CoA) and
Disconnect Message (DM) behavior for RADIUS. Section 3.1 of
[RFC5176] suggests that proxying these messages is possible, but it
does not provide guidance as to how that is done. This omission
means that in practice, proxying of CoA packets is impossible.
Show full document text