Section: 16.1 RADIUS Authentication and Authorization
Content: RADIUS Authentication and Authorization shall be used according to RFC 2865 [38], RFC 3162 [50] and RFC 4818 [97]. The RADIUS client function may reside in a GGSN/P-GW. When the GGSN receives a Create PDP Context request message or the P-GW receives an initial access request (e.g. Create Session Request) the RADIUS client function may send the authentication information to an authentication server, which is identified during the APN provisioning. The authentication server checks that the user can be accepted. The response (when positive) may contain network information, such as an IPv4 address and/or IPv6 prefix for the user when the GGSN or P-GW is interworking with the AAA server. The information delivered during the RADIUS authentication can be used to automatically correlate the users identity (the MSISDN or IMSI) to the IPv4 address and/or IPv6 prefix, if applicable, assigned/confirmed by the GGSN/P-GW or the authentication server respectively. The same procedure applies, in case of sending the authentication to a ‘proxy’ authentication server. RADIUS Authentication is only applicable to the primary PDP context. When the GGSN receives an Access-Accept message from the authentication server it shall complete the PDP context activation procedure. If Access-Reject or no response is received, the GGSN shall reject the PDP Context Activation attempt with a suitable cause code, e.g. User Authentication failed. The GGSN may also use the RADIUS re-authorization procedure for the purpose of IPv4 address allocation to the MS for PDP type of IPv4v6 after establishment of a PDN connection. For EPS, RADIUS Authentication is applicable to the initial access request. When the P-GW receives an Access-Accept message from the authentication server it shall complete the initial access procedure. If Access-Reject or no response is received, the P-GW shall reject the initial access procedure with a suitable cause code. The P-GW may also use the RADIUS re-authorization procedure for the purpose of IPv4 address allocation to the UE for PDN type of IPv4v6 after establishment of a PDN connection. The use cases that may lead this procedure are: - Deferred IPv4 address allocation via DHCPv4 procedure after successful attach on 3GPP accesses. - Deferred IPv4 address allocation after successful attach in trusted non-3GPP IP access on S2a. - Deferred IPv4 home address allocation via DSMIPv6 Re-Registration procedure via S2c.