draft-ietf-dhc-agentopt-radius-07.txt   draft-ietf-dhc-agentopt-radius-08.txt 
Network Working Group R. Droms Network Working Group R. Droms
Internet-Draft J. Schnizlein Internet-Draft J. Schnizlein
Expires: January 5, 2005 Cisco Systems Expires: February 16, 2005 Cisco Systems
July 7, 2004 August 18, 2004
RADIUS Attributes Sub-option for the DHCP Relay Agent Information RADIUS Attributes Sub-option for the DHCP Relay Agent Information
Option Option
draft-ietf-dhc-agentopt-radius-07.txt draft-ietf-dhc-agentopt-radius-08.txt
Status of this Memo Status of this Memo
By submitting this Internet-Draft, I certify that any applicable By submitting this Internet-Draft, I certify that any applicable
patent or other IPR claims of which I am aware have been disclosed, patent or other IPR claims of which I am aware have been disclosed,
and any of which I become aware will be disclosed, in accordance with and any of which I become aware will be disclosed, in accordance with
RFC 3667. RFC 3667.
Internet-Drafts are working documents of the Internet Engineering Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF), its areas, and its working groups. Note that other Task Force (IETF), its areas, and its working groups. Note that other
skipping to change at page 1, line 34 skipping to change at page 1, line 34
and may be updated, replaced, or obsoleted by other documents at any and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress." material or to cite them other than as "work in progress."
The list of current Internet-Drafts can be accessed at http:// The list of current Internet-Drafts can be accessed at http://
www.ietf.org/ietf/1id-abstracts.txt. www.ietf.org/ietf/1id-abstracts.txt.
The list of Internet-Draft Shadow Directories can be accessed at The list of Internet-Draft Shadow Directories can be accessed at
http://www.ietf.org/shadow.html. http://www.ietf.org/shadow.html.
This Internet-Draft will expire on January 5, 2005. This Internet-Draft will expire on February 16, 2005.
Copyright Notice Copyright Notice
Copyright (C) The Internet Society (2004). All Rights Reserved. Copyright (C) The Internet Society (2004). All Rights Reserved.
Abstract Abstract
A NAS (network access server) may choose to authenticate the identity A NAS (network access server) may choose to authenticate the identity
of a device before granting that device access to the network. The of a device before granting that device access to the network. The
IEEE 802.1X protocol is an example of a mechanism for providing IEEE 802.1X protocol is an example of a mechanism for providing
skipping to change at page 3, line 7 skipping to change at page 3, line 7
| | | |
| (3) Access-Accept/Reject | (3) Access-Accept/Reject
v | v |
+-----------------+ +-----------------+
| RADIUS | | RADIUS |
| Server | | Server |
+-----------------+ +-----------------+
Figure 1 Figure 1
In the application described in this document, the access device acts In the application described in this document, the access device acts
as an IEEE 802.1X Authenticator and adds DHCP relay agent options to as an IEEE 802.1X Authenticator and adds a DHCP relay agent option
DHCP messages. At the successful conclusion of IEEE 802.1X which includes a RADIUS Attributes sub-option to DHCP messages. At
authentication, a RADIUS Access-Accept provides attributes for the successful conclusion of IEEE 802.1X authentication, a RADIUS
service authorizations to the NAS. The NAS stores these attributes Access-Accept provides attributes for service authorizations to the
locally. When the NAS subsequently forwards DHCP messages from the NAS. The NAS stores these attributes locally. When the NAS
network device, the NAS adds these attributes in a RADIUS Attributes subsequently forwards DHCP messages from the network device, the NAS
sub-option. The RADIUS Attributes sub-option is another suboption of adds these attributes in a RADIUS Attributes sub-option. The RADIUS
the Relay Agent Information option [5]. Attributes sub-option is another suboption of the Relay Agent
Information option [5].
This document uses IEEE 802.1X as an example to motivate the use of This document uses IEEE 802.1X as an example to motivate the use of
RADIUS by a NAS. The RADIUS Attributes sub-option described in this RADIUS by a NAS. The RADIUS Attributes sub-option described in this
document is not limited to use in conjunction with IEEE 802.1X and document is not limited to use in conjunction with IEEE 802.1X and
can be used to carry RADIUS attributes obtained by the relay agent can be used to carry RADIUS attributes obtained by the relay agent
for any reason. That is, the option is not limited to use with IEEE for any reason. That is, the option is not limited to use with IEEE
802.1X, but is constrained by RADIUS semantics (see Section 4). 802.1X, but is constrained by RADIUS semantics (see Section 4).
The scope of applicability of this specification is such that robust
interoperability is only guaranteed for RADIUS service
implementations that exist within the same scope as the DHCP service
implementation, i.e. within a single, localized administrative
domain. Global interoperability of this specification, across
administrative domains, is not required.
2. Terminology 2. Terminology
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in RFC 2119 [3]. document are to be interpreted as described in RFC 2119 [3].
The use of the standard keywords MUST, SHOULD, MUST NOT and SHOULD
NOT within this specification are with respect to RADIUS clients and
servers that implement the optional features of this specification,
do not create any normative requirements outside of that scope and do
not modify the base RADIUS specifications, such as RFC2865 or
RFC2866.
2.1 DHCP Terminology 2.1 DHCP Terminology
The following terms are used as defined in RFC2131 and RFC3046: DHCP The following terms are used as defined in RFC2131 and RFC3046: DHCP
relay agent, DHCP server, DHCP client. relay agent, DHCP server, DHCP client.
2.2 RADIUS Terminology 2.2 RADIUS Terminology
The following terms are used in conjunction with RADIUS: The following terms are used in conjunction with RADIUS:
RADIUS server: A RADIUS server is responsible for receiving user RADIUS server: A RADIUS server is responsible for receiving user
connection requests, authenticating the user, and then returning connection requests, authenticating the user, and then returning
all configuration information necessary for the client to deliver all configuration information necessary for the client to deliver
service to the user. service to the user.
Attribute: A Type-Length-Value tuple encapsulating data elements as Attribute: A Type-Length-Value tuple encapsulating data elements as
defined in RFC 2865 [4]. defined in RFC 2865 [4].
NAS: A Network Access Server (NAS) provides access to the network NAS: A Network Access Server (NAS) provides access to the network
and operates as a client of RADIUS. The client is responsible for and operates as a client of RADIUS. The client is responsible for
passing user information to designated RADIUS servers, and then passing user information to designated RADIUS servers, and then
acting on the response which is returned. Unlike a traditional acting on the response which is returned. Unlike a traditional
skipping to change at page 4, line 26 skipping to change at page 4, line 40
SubOpt Len RADIUS attributes SubOpt Len RADIUS attributes
code code
+-------+-----+------+------+------+------+--...-+------+ +-------+-----+------+------+------+------+--...-+------+
| TBD | N | o1 | o2 | o3 | o4 | | oN | | TBD | N | o1 | o2 | o3 | o4 | | oN |
+-------+-----+------+------+------+------+--...-+------+ +-------+-----+------+------+------+------+--...-+------+
The RADIUS attributes are encoded according to the encoding rules in The RADIUS attributes are encoded according to the encoding rules in
RFC 2865, in octets o1...oN. RFC 2865, in octets o1...oN.
The NAS truncates the RADIUS attributes to fit in the RADIUS The DHCP relay agent truncates the RADIUS attributes to fit in the
Attributes sub-option. For predictable behavior, the RADIUS server RADIUS Attributes sub-option.
should be configured to return fewer than 255 octets of RADIUS
attributes.
4. RADIUS Server Behavior 4. DHCP Relay Agent Behavior
The RADIUS server that implements this specification MUST be When the DHCP relay agent receives a DHCP message from the client, it
configured to return the User-Name and Class attributes to the NAS, MAY append a DHCP Relay Agent Information option containing the
and MAY return other attributes. RADIUS Attributes sub-option, along with any other sub-options it is
configured to supply. The RADIUS Attributes sub-option MUST only
contain the attributes provided in the RADIUS Access/Accept message.
The DHCP relay agent MUST NOT add more than one RADIUS Attributes
sub-option in a message.
The relay agent MUST include the User-Name and Framed-Pool attributes
in the RADIUS Attributes sub-option if available, and MAY include
other attributes.
To avoid dependencies between the address allocation and other state To avoid dependencies between the address allocation and other state
information between the RADIUS server and the DHCP server, only the information between the RADIUS server and the DHCP server, the DHCP
attributes in the table below SHOULD be included in this sub-option. relay agent SHOULD include only the attributes in the table below an
Because RADIUS servers rely on the directive in section 1.1 or RFC instance of the RADIUS Attributes sub-option. The table, based on
2865 that "A NAS MUST treat a RADIUS access-accept authorizing an the analysis in RFC 3580 [10], lists attributes that MAY be included:
unavailable service as an access-reject instead.", a RADIUS server
SHOULD send only those attributes for which the relay agent can
ensure that either the relay agent or the DHCP server will provide
the associated service. The following table, based on the analysis
in RFC 3580 [10], lists attributes that MAY be included:
# Attribute # Attribute
--- --------- --- ---------
1 User-Name (RFC 2865 [3]) 1 User-Name (RFC 2865 [3])
6 Service-Type (RFC 2865) 6 Service-Type (RFC 2865)
25 Class (RFC 2865)
26 Vendor-Specific (RFC 2865) 26 Vendor-Specific (RFC 2865)
27 Session-Timeout (RFC 2865) 27 Session-Timeout (RFC 2865)
88 Framed-Pool (RFC 2869) 88 Framed-Pool (RFC 2869)
100 Framed-IPv6-Pool (RFC 3162 [8]) 100 Framed-IPv6-Pool (RFC 3162 [8])
5. DHCP Relay Agent Behavior 5. DHCP Server Behavior
When the DHCP relay agent receives a DHCP message from the client, it
MAY append a DHCP Relay Agent Information option containing the
RADIUS Attributes sub-option, along with any other sub-options it is
configured to supply. The RADIUS Attributes sub-option MUST only
contain the attributes provided in the RADIUS Access/Accept message.
The DHCP relay agent MUST NOT add more than one RADIUS Attributes
sub-option in a message.
The relay agent SHOULD include the User-Name and Class attributes in
the RADIUS Attributes sub-option if available, and MAY include other
attributes.
6. DHCP Server Behavior
When the DHCP server receives a message from a relay agent containing When the DHCP server receives a message from a relay agent containing
a RADIUS Attributes sub-option, it extracts the contents of the a RADIUS Attributes sub-option, it extracts the contents of the
sub-option and uses that information in selecting configuration sub-option and uses that information in selecting configuration
parameters for the client. If the relay agent forwards RADIUS parameters for the client. If the relay agent forwards RADIUS
attributes not included in the table in Section 4, the DHCP server attributes not included in the table in Section 4, the DHCP server
SHOULD ignore them. If the DHCP server uses attributes not specified SHOULD ignore them. If the DHCP server uses attributes not specified
here, it might result in side effects not anticipated in the existing here, it might result in side effects not anticipated in the existing
RADIUS specifications. RADIUS specifications.
7. DHCP Client Behavior 6. DHCP Client Behavior
Relay agent options are exchanged only between relay agents and DHCP Relay agent options are exchanged only between relay agents and DHCP
server, so DHCP clients are never aware of their use. server, so DHCP clients are never aware of their use.
8. Security Considerations 7. Security Considerations
Message authentication in DHCP for intradomain use where the Message authentication in DHCP for intradomain use where the
out-of-band exchange of a shared secret is feasible is defined in RFC out-of-band exchange of a shared secret is feasible is defined in RFC
3118 [8]. Potential exposures to attack are discussed in section 7 3118 [8]. Potential exposures to attack are discussed in section 7
of the DHCP protocol specification in RFC 2131 [1]. of the DHCP protocol specification in RFC 2131 [1].
The DHCP Relay Agent option depends on a trusted relationship between The DHCP Relay Agent option depends on a trusted relationship between
the DHCP relay agent and the server, as described in section 5 of RFC the DHCP relay agent and the server, as described in section 5 of RFC
3046 [5]. While the introduction of fraudulent relay-agent options 3046 [5]. While the introduction of fraudulent relay-agent options
can be prevented by a perimeter defense that blocks these options can be prevented by a perimeter defense that blocks these options
unless the relay agent is trusted, a deeper defense using the unless the relay agent is trusted, a deeper defense using the
authentication option for relay agent options [11] or IPsec [12] authentication option for relay agent options [11] or IPsec [12]
SHOULD be deployed as well. SHOULD be deployed as well.
9. IANA Considerations 8. IANA Considerations
IANA has assigned the value of TBD for the DHCP Relay Agent IANA has assigned the value of TBD for the DHCP Relay Agent
Information option sub-option code for this sub-option. This Information option sub-option code for this sub-option. This
document does not define any new namespaces or other constants for document does not define any new namespaces or other constants for
which IANA must maintain a registry. which IANA must maintain a registry.
10. Acknowledgments 9. Acknowledgments
Bernard Aboba's expert advice on avoiding RADIUS entanglements is Expert advice from Bernard Aboba, Paul Funk, David Nelson, Ashwin
gratefully acknowledged. Palekar and Greg Weber on avoiding RADIUS entanglements is gratefully
acknowledged.
Normative References Normative References
[1] Droms, R., "Dynamic Host Configuration Protocol", RFC 2131, [1] Droms, R., "Dynamic Host Configuration Protocol", RFC 2131,
March 1997. March 1997.
[2] Institute of Electrical and Electronics Engineers, "Local and [2] Institute of Electrical and Electronics Engineers, "Local and
Metropolitan Area Networks: Port based Network Access Control", Metropolitan Area Networks: Port based Network Access Control",
IEEE Standard 802.1X, March 2001. IEEE Standard 802.1X, March 2001.
 End of changes. 

This html diff was produced by rfcdiff 1.23, available from http://www.levkowetz.com/ietf/tools/rfcdiff/