Some basics of a AAA Control model John Vollbrecht Merit Network jrv@merit.edu March 30, 2000 Adelaide ietf

AAA Elements and relationships Authentication Server user Authorization Server Application Simple model – single domain/kingdom

Certificate/Token Sequence 1 Authentication Server 2 User agent Authorization Server 3 Application 1- get authentication token 2 – get authorization token 3- initiate application

Net Access Sequence an example Authentication Server 3 4 Authorization Server User Agent 2 5 1 Edge Device 6 1 –request service/ with userinfo 2 – forward request with userinfo 3 – forward request with userinfo 4 – return authentication token 5 – return authorization token 6- return session start

Bandwidth Broker an example 1 Authentication Server 2 3 User agent Authorization Server 4 6 5 Bandwidth Broker 1,2 – get authentication token 3 - request QoS Bandwidth 4 - authorized QoS request 5 – Session start 6 – forward Session start

Some issues Which party controls the request sequence Security requirements between parties in different sequences Possible onetime authorization or authentication Complexity of issues as multiple organizations get involved in Authentication or Authorization or resource/application provisioning

Some Goals One goal is a descriptive model that provides a basis for understanding what is common and what is unique between application domains Attempt to support Policy descriptions of sequences of AAA actions for specific application domains Provide a way to evaluate policy from multiple organizations for a specific request.