draft-ietf-dhc-agentopt-radius-08.txt   rfc4014.txt 
Network Working Group R. Droms Network Working Group R. Droms
Internet-Draft J. Schnizlein Request for Comments: 4014 J. Schnizlein
Expires: February 16, 2005 Cisco Systems Category: Standards Track Cisco Systems
August 18, 2004 February 2005
RADIUS Attributes Sub-option for the DHCP Relay Agent Information
Option
draft-ietf-dhc-agentopt-radius-08.txt
Status of this Memo
By submitting this Internet-Draft, I certify that any applicable
patent or other IPR claims of which I am aware have been disclosed,
and any of which I become aware will be disclosed, in accordance with
RFC 3667.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF), its areas, and its working groups. Note that other
groups may also distribute working documents as Internet-Drafts.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
The list of current Internet-Drafts can be accessed at http:// Remote Authentication Dial-In User Service (RADIUS)
www.ietf.org/ietf/1id-abstracts.txt. Attributes Suboption for the
Dynamic Host Configuration Protocol (DHCP)
Relay Agent Information Option
The list of Internet-Draft Shadow Directories can be accessed at Status of This Memo
http://www.ietf.org/shadow.html.
This Internet-Draft will expire on February 16, 2005. This document specifies an Internet standards track protocol for the
Internet community, and requests discussion and suggestions for
improvements. Please refer to the current edition of the "Internet
Official Protocol Standards" (STD 1) for the standardization state
and status of this protocol. Distribution of this memo is unlimited.
Copyright Notice Copyright Notice
Copyright (C) The Internet Society (2004). All Rights Reserved. Copyright (C) The Internet Society (2005).
Abstract Abstract
A NAS (network access server) may choose to authenticate the identity The RADIUS Attributes suboption enables a network element to pass
of a device before granting that device access to the network. The identification and authorization attributes received during RADIUS
IEEE 802.1X protocol is an example of a mechanism for providing authentication to a DHCP server. When the DHCP server receives a
authenticated layer 2 network access. A network element using RADIUS message from a relay agent containing a RADIUS Attributes suboption,
as an authentication authority will receive attributes from a RADIUS it extracts the contents of the suboption and uses that information
server that may be used by a DHCP server in the selection of in selecting configuration parameters for the client.
configuration parameters to be delivered to the device through its
DHCP client. The RADIUS Attributes sub-option enables a network
element to pass along attributes for the user of a device received
during RADIUS authentication to a DHCP server.
1. Introduction and Background 1. Introduction and Background
The RADIUS Attributes sub-option for the DHCP Relay Agent option The RADIUS Attributes suboption for the DHCP Relay Agent option
provides a way in which a NAS can pass attributes obtained from a provides a way in which a NAS can pass attributes obtained from a
RADIUS server to a DHCP server [1]. IEEE 802.1X [2] is an example of RADIUS server to a DHCP server [1]. IEEE 802.1X [2] is an example of
a mechanism through which a NAS such as a switch or a wireless LAN a mechanism through which a NAS such as a switch or a wireless LAN
access point can authenticate the identity of the user of a device access point can authenticate the identity of the user of a device
before providing layer 2 network access using RADIUS as the before providing layer 2 network access with RADIUS as the
Authentication Service specified in RFC3580 [10]. In IEEE 802.1X Authentication Service, as specified in RFC 3580 [8]. In IEEE 802.1X
authenticated access, a device must first exchange some authenticated access, a device must first exchange some
authentication credentials with the NAS. The NAS then supplies these authentication credentials with the NAS. The NAS then supplies these
credentials to a RADIUS server, which eventually sends either an credentials to a RADIUS server, which eventually sends either an
Access-Accept or an Access-Reject in response to an Access-Request. Access-Accept or an Access-Reject in response to an Access-Request.
The NAS, based on the reply of the RADIUS server, then allows or The NAS, based on the reply of the RADIUS server, then allows or
denies network access to the requesting device. denies network access to the requesting device.
Figure 1 summarizes the message exchange among the participants in Figure 1 summarizes the message exchange among the participants in
IEEE 802.1X authentication. IEEE 802.1X authentication.
skipping to change at page 3, line 4 skipping to change at page 2, line 33
| ^ | ^
| | | |
(2) Request for authentication (2) Request for authentication
| | | |
| (3) Access-Accept/Reject | (3) Access-Accept/Reject
v | v |
+-----------------+ +-----------------+
| RADIUS | | RADIUS |
| Server | | Server |
+-----------------+ +-----------------+
Figure 1 Figure 1
In the application described in this document, the access device acts The access device acts as an IEEE 802.1X Authenticator and adds a
as an IEEE 802.1X Authenticator and adds a DHCP relay agent option DHCP relay agent option that includes a RADIUS Attributes suboption
which includes a RADIUS Attributes sub-option to DHCP messages. At to DHCP messages. At the successful conclusion of IEEE 802.1X
the successful conclusion of IEEE 802.1X authentication, a RADIUS authentication, a RADIUS Access-Accept provides attributes for
Access-Accept provides attributes for service authorizations to the service authorizations to the NAS. The NAS stores these attributes
NAS. The NAS stores these attributes locally. When the NAS locally. When the NAS subsequently relays DHCP messages from the
subsequently forwards DHCP messages from the network device, the NAS network device, the NAS adds these attributes in a RADIUS Attributes
adds these attributes in a RADIUS Attributes sub-option. The RADIUS suboption. The RADIUS Attributes suboption is another suboption of
Attributes sub-option is another suboption of the Relay Agent the Relay Agent Information option [5].
Information option [5].
This document uses IEEE 802.1X as an example to motivate the use of The RADIUS Attributes suboption described in this document is not
RADIUS by a NAS. The RADIUS Attributes sub-option described in this limited to use in conjunction with IEEE 802.1X and can be used to
document is not limited to use in conjunction with IEEE 802.1X and carry RADIUS attributes obtained by the relay agent for any reason.
can be used to carry RADIUS attributes obtained by the relay agent That is, the option is not limited to use with IEEE 802.1X but is
for any reason. That is, the option is not limited to use with IEEE constrained by RADIUS semantics (see Section 4).
802.1X, but is constrained by RADIUS semantics (see Section 4).
The scope of applicability of this specification is such that robust The scope of applicability of this specification is such that robust
interoperability is only guaranteed for RADIUS service interoperability is only guaranteed for RADIUS service
implementations that exist within the same scope as the DHCP service implementations that exist within the same scope as does the DHCP
implementation, i.e. within a single, localized administrative service implementation, i.e., within a single, localized
domain. Global interoperability of this specification, across administrative domain. Global interoperability of this
administrative domains, is not required. specification, across administrative domains, is not required.
2. Terminology 2. Terminology
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in RFC 2119 [3]. document are to be interpreted as described in RFC 2119 [3].
The use of the standard keywords MUST, SHOULD, MUST NOT and SHOULD Within this specification, the use of the key words "MUST", "MUST
NOT within this specification are with respect to RADIUS clients and NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT",
servers that implement the optional features of this specification, "RECOMMENDED", "MAY", and "OPTIONAL" is with respect to RADIUS
do not create any normative requirements outside of that scope and do clients and servers that implement the optional features of this
not modify the base RADIUS specifications, such as RFC2865 or specification. The use of these key words does not create any
RFC2866. normative requirements outside of that scope, and does not modify the
base RADIUS specifications, such as RFC 2865 [4].
2.1 DHCP Terminology 2.1. DHCP Terminology
The following terms are used as defined in RFC2131 and RFC3046: DHCP The following terms are used as defined in RFC 2131 and RFC 3046:
relay agent, DHCP server, DHCP client. DHCP relay agent, DHCP server, DHCP client.
2.2 RADIUS Terminology 2.2. RADIUS Terminology
The following terms are used in conjunction with RADIUS: The following terms are used in conjunction with RADIUS:
RADIUS server: A RADIUS server is responsible for receiving user RADIUS server: A RADIUS server is responsible for receiving user
connection requests, authenticating the user, and then returning connection requests, authenticating the user, and then returning
all configuration information necessary for the client to deliver all configuration information necessary for the client to deliver
service to the user. service to the user.
Attribute: A Type-Length-Value tuple encapsulating data elements as Attribute: A Type-Length-Value tuple encapsulating data elements as
defined in RFC 2865 [4]. defined in RFC 2865 [4].
NAS: A Network Access Server (NAS) provides access to the network NAS: A Network Access Server (NAS) provides access to the network
and operates as a client of RADIUS. The client is responsible for and operates as a client of RADIUS. The client is responsible for
passing user information to designated RADIUS servers, and then passing user information to designated RADIUS servers and then
acting on the response which is returned. Unlike a traditional acting on the response that is returned. Unlike a traditional
dial NAS, the NAS considered here may not have a protocol like PPP dial NAS, the NAS considered here may not have a protocol such as
through which it can pass configuration information from the PPP through which it can pass configuration information from the
RADIUS attributes to the client RADIUS attributes to the client.
2.3 IEEE 802.1X Terminology 2.3. IEEE 802.1X Terminology
The following terms are used as defined in the IEEE 802.1X protocol: The following terms are used as defined in the IEEE 802.1X protocol:
Authenticator, Supplicant. Authenticator, Supplicant.
3. RADIUS Attributes sub-option format 3. RADIUS Attributes Suboption Format
The RADIUS Attributes Sub-option is a new sub-option for the DHCP The RADIUS Attributes suboption is a new suboption for the DHCP Relay
Relay Agent option. Agent option.
The format of the RADIUS Attributes sub-option is: The format of the RADIUS Attributes suboption is as follows:
SubOpt Len RADIUS attributes SubOpt Len RADIUS attributes
code code
+-------+-----+------+------+------+------+--...-+------+ +-------+-----+------+------+------+------+--...-+------+
| TBD | N | o1 | o2 | o3 | o4 | | oN | | 7 | N | o1 | o2 | o3 | o4 | | oN |
+-------+-----+------+------+------+------+--...-+------+ +-------+-----+------+------+------+------+--...-+------+
The RADIUS attributes are encoded according to the encoding rules in The RADIUS attributes are encoded according to the encoding rules in
RFC 2865, in octets o1...oN. RFC 2865, in octets o1...oN.
The DHCP relay agent truncates the RADIUS attributes to fit in the The DHCP relay agent truncates the RADIUS attributes to fit in the
RADIUS Attributes sub-option. RADIUS Attributes suboption.
4. DHCP Relay Agent Behavior 4. DHCP Relay Agent Behavior
When the DHCP relay agent receives a DHCP message from the client, it When the DHCP relay agent receives a DHCP message from the client, it
MAY append a DHCP Relay Agent Information option containing the MAY append a DHCP Relay Agent Information option containing the
RADIUS Attributes sub-option, along with any other sub-options it is RADIUS Attributes suboption, along with any other suboptions it is
configured to supply. The RADIUS Attributes sub-option MUST only configured to supply. The RADIUS Attributes suboption MUST only
contain the attributes provided in the RADIUS Access/Accept message. contain the attributes provided in the RADIUS Access/Accept message.
The DHCP relay agent MUST NOT add more than one RADIUS Attributes The DHCP relay agent MUST NOT add more than one RADIUS Attributes
sub-option in a message. suboption in a message.
The relay agent MUST include the User-Name and Framed-Pool attributes The relay agent MUST include the User-Name and Framed-Pool attributes
in the RADIUS Attributes sub-option if available, and MAY include in the RADIUS Attributes suboption, if they are available, and MAY
other attributes. include other attributes.
To avoid dependencies between the address allocation and other state To avoid dependencies between the address allocation and other state
information between the RADIUS server and the DHCP server, the DHCP information between the RADIUS server and the DHCP server, the DHCP
relay agent SHOULD include only the attributes in the table below an relay agent SHOULD include only the attributes in the table below in
instance of the RADIUS Attributes sub-option. The table, based on an instance of the RADIUS Attributes suboption. The table, based on
the analysis in RFC 3580 [10], lists attributes that MAY be included: the analysis in RFC 3580 [8], lists attributes that MAY be included:
# Attribute # Attribute
--- --------- --- ---------
1 User-Name (RFC 2865 [3]) 1 User-Name (RFC 2865 [3])
6 Service-Type (RFC 2865) 6 Service-Type (RFC 2865)
26 Vendor-Specific (RFC 2865) 26 Vendor-Specific (RFC 2865)
27 Session-Timeout (RFC 2865) 27 Session-Timeout (RFC 2865)
88 Framed-Pool (RFC 2869) 88 Framed-Pool (RFC 2869)
100 Framed-IPv6-Pool (RFC 3162 [8]) 100 Framed-IPv6-Pool (RFC 3162 [7])
5. DHCP Server Behavior 5. DHCP Server Behavior
When the DHCP server receives a message from a relay agent containing When the DHCP server receives a message from a relay agent containing
a RADIUS Attributes sub-option, it extracts the contents of the a RADIUS Attributes suboption, it extracts the contents of the
sub-option and uses that information in selecting configuration suboption and uses that information in selecting configuration
parameters for the client. If the relay agent forwards RADIUS parameters for the client. If the relay agent relays RADIUS
attributes not included in the table in Section 4, the DHCP server attributes not included in the table in Section 4, the DHCP server
SHOULD ignore them. If the DHCP server uses attributes not specified SHOULD ignore them. If the DHCP server uses attributes not specified
here, it might result in side effects not anticipated in the existing here, it might result in side effects not anticipated in the existing
RADIUS specifications. RADIUS specifications.
6. DHCP Client Behavior 6. DHCP Client Behavior
Relay agent options are exchanged only between relay agents and DHCP Relay agent options are exchanged only between relay agents and the
server, so DHCP clients are never aware of their use. DHCP server, so DHCP clients are never aware of their use.
7. Security Considerations 7. Security Considerations
Message authentication in DHCP for intradomain use where the Message authentication in DHCP for intradomain use where the
out-of-band exchange of a shared secret is feasible is defined in RFC out-of-band exchange of a shared secret is feasible is defined in RFC
3118 [8]. Potential exposures to attack are discussed in section 7 3118 [6]. Potential exposures to attack are discussed in section 7
of the DHCP protocol specification in RFC 2131 [1]. of the DHCP protocol specification in RFC 2131 [1].
The DHCP Relay Agent option depends on a trusted relationship between The DHCP Relay Agent option depends on a trusted relationship between
the DHCP relay agent and the server, as described in section 5 of RFC the DHCP relay agent and the server, as described in section 5 of RFC
3046 [5]. While the introduction of fraudulent relay-agent options 3046 [5]. Although the introduction of fraudulent relay-agent
can be prevented by a perimeter defense that blocks these options options can be prevented by a perimeter defense that blocks these
unless the relay agent is trusted, a deeper defense using the options unless the relay agent is trusted, a deeper defense using the
authentication option for relay agent options [11] or IPsec [12] authentication option for relay agent options [9] or IPsec [10]
SHOULD be deployed as well. SHOULD be deployed as well.
8. IANA Considerations 8. IANA Considerations
IANA has assigned the value of TBD for the DHCP Relay Agent IANA has assigned the value of 7 for the DHCP Relay Agent Information
Information option sub-option code for this sub-option. This option suboption code for this suboption. This document does not
document does not define any new namespaces or other constants for define any new namespaces or other constants for which IANA must
which IANA must maintain a registry. maintain a registry.
9. Acknowledgments 9. Acknowledgements
Expert advice from Bernard Aboba, Paul Funk, David Nelson, Ashwin Expert advice from Bernard Aboba, Paul Funk, David Nelson, Ashwin
Palekar and Greg Weber on avoiding RADIUS entanglements is gratefully Palekar, and Greg Weber on avoiding RADIUS entanglements is
acknowledged. gratefully acknowledged.
Normative References 10. References
10.1. Normative References
[1] Droms, R., "Dynamic Host Configuration Protocol", RFC 2131, [1] Droms, R., "Dynamic Host Configuration Protocol", RFC 2131,
March 1997. March 1997.
[2] Institute of Electrical and Electronics Engineers, "Local and [2] Institute of Electrical and Electronics Engineers, "Local and
Metropolitan Area Networks: Port based Network Access Control", Metropolitan Area Networks: Port based Network Access Control",
IEEE Standard 802.1X, March 2001. IEEE Standard 802.1X, March 2001.
[3] Bradner, S., "Key words for use in RFCs to Indicate Requirement [3] Bradner, S., "Key words for use in RFCs to Indicate Requirement
Levels", BCP 14, RFC 2119, March 1997. Levels", BCP 14, RFC 2119, March 1997.
[4] Rigney, C., Willens, S., Rubens, A. and W. Simpson, "Remote [4] Rigney, C., Willens, S., Rubens, A., and W. Simpson, "Remote
Authentication Dial In User Service (RADIUS)", RFC 2865, June Authentication Dial In User Service (RADIUS)", RFC 2865, June
2000. 2000.
[5] Patrick, M., "DHCP Relay Agent Information Option", RFC 3046, [5] Patrick, M., "DHCP Relay Agent Information Option", RFC 3046,
January 2001. January 2001.
Informative References 10.2. Informative References
[6] Rigney, C., "RADIUS Accounting", RFC 2866, June 2000.
[7] Rigney, C., Willats, W. and P. Calhoun, "RADIUS Extensions",
RFC 2869, June 2000.
[8] Droms, R. and W. Arbaugh, "Authentication for DHCP Messages", [6] Droms, R. and W. Arbaugh, "Authentication for DHCP Messages",
RFC 3118, June 2001. RFC 3118, June 2001.
[9] Aboba, B., Zorn, G. and D. Mitton, "RADIUS and IPv6", RFC 3162, [7] Aboba, B., Zorn, G., and D. Mitton, "RADIUS and IPv6", RFC 3162,
August 2001. August 2001.
[10] Congdon, P., Aboba, B., Smith, A., Zorn, G. and J. Roese, "IEEE [8] Congdon, P., Aboba, B., Smith, A., Zorn, G., and J. Roese, "IEEE
802.1X Remote Authentication Dial In User Service (RADIUS) 802.1X Remote Authentication Dial In User Service (RADIUS) Usage
Usage Guidelines", RFC 3580, September 2003. Guidelines", RFC 3580, September 2003.
[11] Stapp, M. and T. Lemon, "The Authentication Suboption for the [9] Stapp, M. and T. Lemon, "The Authentication Suboption for the
DHCP Relay Agent Option", draft-ietf-dhc-auth-suboption-02 DHCP Relay Agent Option", Work in Progress, October 2003.
(work in progress), October 2003.
[12] Droms, R., "Authentication of DHCP Relay Agent Options Using [10] Droms, R., "Authentication of DHCP Relay Agent Options Using
IPsec", draft-ietf-dhc-relay-agent-ipsec-00 (work in progress), IPsec", Work in Progress, September 2003.
September 2003.
Authors' Addresses Authors' Addresses
Ralph Droms Ralph Droms
Cisco Systems Cisco Systems
1414 Massachusetts Avenue 1414 Massachusetts Avenue
Boxborough, MA 01719 Boxborough, MA 01719
USA USA
EMail: rdroms@cisco.com EMail: rdroms@cisco.com
John Schnizlein John Schnizlein
Cisco Systems Cisco Systems
9123 Loughran Road 9123 Loughran Road
Fort Washington, MD 20744 Fort Washington, MD 20744
USA USA
EMail: jschnizl@cisco.com EMail: jschnizl@cisco.com
Intellectual Property Statement Full Copyright Statement
Copyright (C) The Internet Society (2005).
This document is subject to the rights, licenses and restrictions
contained in BCP 78, and except as set forth therein, the authors
retain all their rights.
This document and the information contained herein are provided on an
"AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property
The IETF takes no position regarding the validity or scope of any The IETF takes no position regarding the validity or scope of any
Intellectual Property Rights or other rights that might be claimed to Intellectual Property Rights or other rights that might be claimed to
pertain to the implementation or use of the technology described in pertain to the implementation or use of the technology described in
this document or the extent to which any license under such rights this document or the extent to which any license under such rights
might or might not be available; nor does it represent that it has might or might not be available; nor does it represent that it has
made any independent effort to identify any such rights. Information made any independent effort to identify any such rights. Information
on the IETF's procedures with respect to rights in IETF Documents can on the IETF's procedures with respect to rights in IETF Documents can
be found in BCP 78 and BCP 79. be found in BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat and any Copies of IPR disclosures made to the IETF Secretariat and any
assurances of licenses to be made available, or the result of an assurances of licenses to be made available, or the result of an
attempt made to obtain a general license or permission for the use of attempt made to obtain a general license or permission for the use of
such proprietary rights by implementers or users of this such proprietary rights by implementers or users of this
specification can be obtained from the IETF on-line IPR repository at specification can be obtained from the IETF on-line IPR repository at
http://www.ietf.org/ipr. http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any The IETF invites any interested party to bring to its attention any
copyrights, patents or patent applications, or other proprietary copyrights, patents or patent applications, or other proprietary
rights that may cover technology that may be required to implement rights that may cover technology that may be required to implement
this standard. Please address the information to the IETF at this standard. Please address the information to the IETF at ietf-
ietf-ipr@ietf.org. ipr@ietf.org.
The IETF has been notified of intellectual property rights claimed in
regard to some or all of the specification contained in this
document. For more information consult the online list of claimed
rights.
Disclaimer of Validity
This document and the information contained herein are provided on an
"AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Copyright Statement
Copyright (C) The Internet Society (2004). This document is subject
to the rights, licenses and restrictions contained in BCP 78, and
except as set forth therein, the authors retain all their rights.
Acknowledgment Acknowledgement
Funding for the RFC Editor function is currently provided by the Funding for the RFC Editor function is currently provided by the
Internet Society. Internet Society.
 End of changes. 

This html diff was produced by rfcdiff 1.25, available from http://www.levkowetz.com/ietf/tools/rfcdiff/