Data Objects and Message Types

1. Data Objects and Message Types 49th IETF AAAarch Research Group David Spence Interlink Networks

2. Service request/reply Authorization request/reply Solicit Service Offer request/reply Authentication request/reply Authentication Challenge request/reply Policy request/reply Policy Evaluation request/reply Data request/reply Event Log indication/confirmation Accounting indication/confirmation Service (session) Configuration indication/confirmation Service (session) Management indication/confirmation Capability request/reply (supports resource discovery) Message Types

3. Identity Authentication Data Authentication Challenge Service Data Service Offer Answer Error Policy Policy Reference Policy Data Configuration Data Service Management Accounting Event Capability Top Level Objects

4. Relation of Objects to Message Types

5. Service request/reply • A Service Request is a request to provide some service. It may be passed through a chain of AAA entities depending on whether the push, pull, or agent model is being used. Implicit in a request for service is a request for authentication and authorization. Typical top level objects carried in a Service Request include: • Identity • Authentication Data • Service Data or Service Specification Policy • Policy Data • A Service Reply is returned back down the chain. It may be positive or negative. If positive, it might contain objects such as: • Answer (= Yes) • Service Data (the negotiated service parameters) • Configuration Data (to be sent to the service equipment) • If the reply is negative it might contain objects such as: • Answer (= No) • Error • Service Offer

6. Authorization request/reply • An Authorization Request seeks to know if a specified service is authorized. Typical top level objects include: • Identity • Service Data or Service Specification Policy • Policy Data • An Authorization Reply might contain: • Answer • Error

7. Solicit Service Offer request/reply • A Solicit Service Offer Request is sent to discover what service parameters are supported by a service provider. It may be sent through a broker. It might contain the following object to indicate in broadest terms what type of service is of interest: • Service Data • The Solicit Service Offer Reply would contain the following object: • Service Offer

8. Authentication request/reply • An Authentication Request is sent to an AAA server to request it to authenticate a user or to forward the request to an AAA server that can. The Authentication Request might contain: • Identity • Authentication Data • The Authentication Reply might simply contain: • Answer

9. Authentication Challenge request/reply • The Authentication Challenge Request is sent toward a user to support challenge type authentication algorithms. It would contain the following object: • Authentication Challenge • The Authentication Challenge Reply would contain: • Authentication Data

10. Policy request/reply • The Policy Request is sent to an AAA server to obtain a remote policy. It would contain: • Policy Reference • The Policy Reply would contain: • Policy

11. Policy Evaluation request/reply • The Policy Evaluation Request is sent to an AAA server to request it to evaluate a policy. It would contain: • Policy, or • Policy Reference, and possibly • Policy Data • Policy Evaluation Reply would contain: • Answer • Service Data (optional) • Configuration Data (optional)

12. Data request/reply • A Data Request is sent to retrieve policy data from a remote AAA server. It would contain the following object to specify the data elements it wants to retrieve. However, no data values would be given: • Policy Data • The reply would return the object with the values filled in. • Policy Data

13. Event Log indication/confirmation • An Event Log Indication is sent to request another AAA server to log an event. It contains: • Event • The Event Log Confirmation contains: • Answer • Error (if Answer=No)

14. Accounting indication/confirmation • An Accounting Indication is sent to an Accounting server. It may be forwarded through a proxy or broker. It contains: • Accounting • An Accounting Confirmation is returned to indicate that the accounting data has been committed to stable storage. It contains: • Answer • Error (if Answer=No)

15. Service Configuration indication/confirmation • A Service Configuration Indication may be sent to a Service Provider to suggest configuration parameters for the service to be provided. It contains: • Configuration Data • A Service Configuration Confirmation contains: • Answer • Error (If Answer=No) • Note: Is Service Configuration really needed or will Service request/reply suffice?

16. Service Management indication/confirmation • The Service Management Indication is sent to the Service Provider AAA Server to manage a service pending or in progress. It may contain the following objects: • Service Management • Service Data (optional) • Configuration Data (optional) • Management operations include: • Service termination • Modifying service parameters • The Service Management Confirmation contains: • Answer • Error (if Answer=No)

17. Capability request/reply • The Capability Request seeks to discover the capabilities or roles of an AAA server. It contains: • Capability • The Capability Reply contains: • Capability