10. New Values for Existing AVPs
This section defines new values that the Diameter SIP application
extends to already existing AVPs.
10.1. Extension to the Result-Code AVP Values
The Result-Code AVP is already defined in RFC 3588 [RFC3588]. In
addition to the values already defined in RFC 3588 [RFC3588], the
Diameter SIP application defines the following new Result-Code AVP
10.1.1. Success Result-Code AVP Values
A Diameter peer uses Result-Code AVP values that fall into the
success category to inform the remote peer that a request has been
o DIAMETER_FIRST_REGISTRATION 2003
The user was not previously registered. The Diameter server has
now authorized the registration.
o DIAMETER_SUBSEQUENT_REGISTRATION 2004
The user is already registered. The Diameter server has now
authorized the re-registration.
o DIAMETER_UNREGISTERED_SERVICE 2005
The user is not currently registered, but the requested service
can still be granted to the user.
o DIAMETER_SUCCESS_SERVER_NAME_NOT_STORED 2006
The request operation was successfully processed. The Diameter
server does not keep a record of the SIP server address assigned
to the user.
o DIAMETER_SERVER_SELECTION 2007
The Diameter server has authorized the registration. The user has
already been assigned a SIP server, but it may be necessary to
select a new SIP server for the user.
o DIAMETER_SUCCESS_AUTH_SENT_SERVER_NOT_STORED 2008
The requested operation was successfully executed. The Diameter
server is sending a number of authentication credentials in the
answer message. The Diameter server does not keep a record of the
10.1.2. Transient Failures Result-Code AVP Values
A Diameter peer uses a Result-Code AVP value that falls in the
transient failures category to inform the remote peer that a request
could not be satisfied at the time it was received, but it MAY be
satisfied by the Diameter peer in the future.
o DIAMETER_USER_NAME_REQUIRED 4013
The Diameter request did not contain a User-Name AVP, which is
required to complete the transaction. The Diameter peer MAY
include a User-Name AVP and attempt the request again.
10.1.3. Permanent Failures Result-Code AVP Values
A Diameter peer uses a Result-Code AVP value that falls into the
permanent failure category to inform the remote peer that the request
failed and should not be attempted again.
o DIAMETER_ERROR_USER_UNKNOWN 5032
The SIP-AOR AVP value does not belong to a known user in this
o DIAMETER_ERROR_IDENTITIES_DONT_MATCH 5033
The value in one of the SIP-AOR AVPs is not allocated to the user
specified in the User-Name AVP.
o DIAMETER_ERROR_IDENTITY_NOT_REGISTERED 5034
A query for location information is received for a SIP AOR that
has not been registered before. The user to which this identity
belongs cannot be given service in this situation.
o DIAMETER_ERROR_ROAMING_NOT_ALLOWED 5035
The user is not allowed to roam to the visited network.
o DIAMETER_ERROR_IDENTITY_ALREADY_REGISTERED 5036
The identity being registered has already been assigned a server
and the registration status does not allow that it is overwritten.
o DIAMETER_ERROR_AUTH_SCHEME_NOT_SUPPORTED 5037
The authentication scheme indicated in an authentication request
is not supported.
o DIAMETER_ERROR_IN_ASSIGNMENT_TYPE 5038
The SIP server address sent in the SIP-Server-URI AVP value of the
Diameter Server-Assignment-Request (SAR) command is the same SIP
server address that is currently assigned to the user name, but
the SIP-Server-Assignment-Type AVP is not allowed. For example,
the user is registered and the Server-Assignment-Request indicates
the assignment for an unregistered user.
o DIAMETER_ERROR_TOO_MUCH_DATA 5039
The Diameter peer in the SIP server receives more data than it can
accept. The SIP server cannot overwrite the already stored data.
o DIAMETER_ERROR_NOT SUPPORTED_USER_DATA 5040
The SIP server informs the Diameter server that the received
subscription data contained information that was not recognized or
11. Authentication Details
Authenticating a user can occur through various mechanisms.
Currently HTTP Digest authentication is supported. The actual
authentication is performed in either the SIP server or the Diameter
If the Diameter server wants to assure that authentication will take
place in the Diameter server (as opposed to a delegated
authentication taking place in the SIP server), it MUST NOT include a
Digest-HA1 AVP (part of the grouped SIP-Authenticate AVP, which in
turn is part of the SIP-Auth-Data-Item AVP) in a MAA message. The
Diameter server MAY include a pre-calculated Digest-HA1 AVP in the
MAA message if it wants to delegate authentication of the user to the
Note that on systems where the SIP User Agent is using HTTP Digest
authentication [RFC2617] inside of Transport Layer Security (TLS)
[RFC4346], where only the SIP proxy server has a certificate,
delegating authentication to the SIP server (by making Digest-HA1
available to the SIP server) might reduce the load on the Diameter
When requesting authentication, the Diameter client indicates in the
SIP-Number-Auth-Items AVP value of a Diameter MAR message how many
authentication credentials are being requested. In the Diameter MAA
message, the Diameter server MAY include more than one
SIP-Auth-Data-Item AVP, but it is only useful for the Diameter client
if the Digest-QoP AVP was set to 'auth-int' (in the MAR message), and
if future authentications will have the same realm. When including
more than one SIP-Auth-Data-Item AVP, the Diameter server SHOULD
indicate how many instances of SIP-Auth-Data-Item AVPs are present
with the SIP-Number-Auth-Items AVP. This number may be different
from the one requested in the Diameter MAR message. If multiple
SIP-Auth-Data-Item AVPs are present, and their ordering is
significant, the Diameter server MUST include a SIP-Item-Number AVP
in each grouping to indicate the order. The
SIP-Authentication-Scheme AVP indicates "Digest" and the
SIP-Authenticate AVP contains data (typically a challenge of some
kind) that the user can use for her authentication. The grouped
SIP-Authorization AVP contains the AVPs that conform to the response
expected from the user.
If the Diameter server performs the authentication of the user, the
Diameter MAR message that the Diameter client sends to the Diameter
server MUST include all the authentication credentials supplied by
the SIP UA (there might be more than one credential, e.g., different
realms, authentication of proxies, etc.). Each credential is
inserted in a grouped SIP-Authorization AVP (part of the grouped
SIP-Auth-Data-Item AVP). The Diameter client MUST insert a
SIP-Number-Auth-Items AVP with the value set to the number of
credentials enclosed. If necessary, the Digest-Entity-Body-Hash AVP
will contain a hash of the body, needed to perform the
authentication. If the authentication is successful, the Diameter
MAA message will contain a Result-Code AVP indicating success, and if
necessary, the Diameter server MAY include one or more
SIP-Auth-Data-Item AVPs to provide further authentication credentials
to the SIP server. If the authentication is unsuccessful due to
missing credentials, the Diameter MAA message will include a
SIP-Auth-Data-Item AVP with the SIP-Authentication-Scheme and
SIP-Authenticate AVPs containing data (typically a challenge of some
kind) that the user can use to authenticate itself.
There are situations where a SIP request traverses several proxies,
and each of the proxies requests to authenticate the SIP UA. In this
situation, it is a valid scenario that a SIP request received at a
SIP server contains several sets of credentials. The 'realm'
directive in HTTP is the key that the Diameter client can use to
determine which credential is applicable. Also, none of the realms
may be of interest to the Diameter client, in which case the Diameter
client MUST consider that no credentials (of interest) were sent. In
any case, a Diameter client MUST send zero or exactly one credential
to the Diameter server. The Diameter client MUST choose the
credential based on the 'realm' directive in the
Authorization/Proxy-Authorization header field, and it MUST match the
realm of the Diameter client.
It must be noted that nonces are always generated in the Diameter
12. Migration from RADIUS
RADIUS offers support for HTTP Digest authentication in the RADIUS
Extension for Digest Authentication [RFC4590]. A number of AVPs (the
Digest-* AVPs) of this Diameter SIP application are imported from the
RADIUS attributes namespace, thus making the migration from RADIUS to
Note that the RADIUS Extension for Digest Authentication [RFC4590]
provides a more limited scope than this Diameter SIP application.
Specifically, the RADIUS extension for Digest Authentication merely
provides support for HTTP Digest authentication, whereas the Diameter
SIP application provides support for user location, profile
downloading and update, etc.
The following sections discuss several configurations in which a
gateway translates RADIUS to Diameter and vice versa.
12.1. Gateway from RADIUS Client to Diameter Server
The gateway maps Access-Request messages to MAR request. If a RADIUS
Access-Request message contains at least one Digest-* attribute, the
gateway maps all Digest-* attributes to the AVPs of a Diameter
SIP-Authorization AVP, constructs a MAR message, and sends it to the
Diameter server. If the RADIUS Access-Request message does not
contain any Digest-* attribute, then the RADIUS client does not want
to apply HTTP Digest authentication, in which case, actions at the
gateway are outside the scope of this document.
The Diameter server responds with a MAA message. If the MAA message
contains a Result-Code AVP set to the value DIAMETER_MULTI_ROUND_AUTH
and contains challenge parameters in a SIP-Authenticate AVP, then the
gateway translates the AVPs of SIP-Authenticate AVP and puts the
resulting RADIUS attributes into an Access-Challenge message. It
sends the Access-Challenge message to the RADIUS client.
If the MAA message contains a SIP-Authentication-Info and a
Digest-Response AVP, the gateway converts these AVPs to the
corresponding RADIUS attributes and constructs a RADIUS message. If
the Result-Code AVP is DIAMETER_SUCCESS, an Access-Accept is sent.
In all other cases, an Access-Reject is sent.
12.2. Gateway from Diameter Client to RADIUS Server
The Diameter client sends a Diameter MAR message to the gateway. If
the MAR message does not contain SIP-Auth-Data-Item AVPs, the gateway
constructs an Access-Request message and maps the SIP-AOR and
SIP-Method AVPs to RADIUS attributes. The gateway sends the
Access-Request message to the RADIUS server, which will respond with
an Access-Challenge. The gateway creates a MAA message with a
Result-Code AVP set to DIAMETER_MULTI_ROUND_AUTH and maps the
Digest-* attributes to Diameter AVPs in a SIP-Authenticate AVP. The
gateway sends the resulting MAA to the Diameter client, which will
respond with a new MAR.
The gateway checks the SIP-Auth-Data-Item AVPs of this MAR for an AVP
where the Digest-Realm AVP matches the locally configured realm
value. It takes the AVPs from this SIP-Auth-Data-Item AVP, converts
them into the corresponding RADIUS attributes and constructs a RADIUS
Access-Request message. The gateway sends the Access-Request message
to the RADIUS server. If the RADIUS server responds with an
Access-Accept message, the gateway converts the RADIUS attributes to
Diameter AVPs, constructs a MAA message with a Result-Code AVP set to
DIAMETER_SUCCESS and sends this message to the Diameter client. If
the RADIUS server responds with an Access-Reject message, the gateway
converts the RADIUS attributes to Diameter AVPs, constructs a MAA
message with a Result-Code AVP set to
DIAMETER_ERROR_IDENTITIES_DONT_MATCH, and sends this message to the
12.3. Known Limitations
As mentioned earlier, there is not a 100% match between the Diameter
SIP application and the RADIUS Extension for Digest Authentication
[RFC4590]. In particular, the RADIUS Extension for Digest
Authentication [RFC4590] does not offer equivalent functionality to
the Diameter UAR/UAA, SAR/SAA, LIR/LIA, RTR/RTA, and PPR/PPA messages
defined by this specification.
13. IANA Considerations
This document serves as IANA registration request for a number of
items that should be registered in the AAA parameters registry.
13.1. Application Identifier
This document defines a standards-track Application-ID that falls
into the Application Identifier standards-track address space defined
by RFC 3588 [RFC3588] Section 11.3. This Application-ID has been
registered in the Application IDs sub-registry of the AAA parameters
registry with the following data:
ID values Name Reference
----------- ------------------------ ---------
6 Diameter Session Initiation RFC 4740
Protocol (SIP) Application
13.2. Command Codes
This document defines new standard commands whose Command Codes are
to be allocated within the standard permanent Command Codes address
space defined in RFC 3588 [RFC3588] Section 11.2.1. These command
codes should be registered in the Command Codes sub-registry of the
AAA parameters registry.
Table 1 in Section 8 contains the detailed list of Command Code names
and values that are part of this Diameter application.
13.3. AVP Codes
This document defines new standard AVPs, whose AVP Codes are to be
allocated within the AVP Codes address space defined in RFC 3588
[RFC3588] Section 11.4. These AVP codes have been registered in the
AVP Codes sub-registry of the AAA parameters registry.
Table 2 in Section 9 contains the detailed list of AVP names and AVP
codes that are part of this Diameter application.
13.4. Additional Values for the Result-Code AVP Value
This document defines new standard Result-Code AVP values to be
allocated within the Result-Code AVP address space defined in RFC
3588 [RFC3588] Section 14.4.1. These values are listed in the
Result-Code AVP values section of the AVP Specific Values
sub-registry of the AAA parameters registry.
Section 10.1.1 lists the new Result-Code AVP values that fall into
the success category, according to RFC 3588 [RFC3588] Section 7.1.2.
Section 10.1.2 lists the new Result-Code AVP values that fall into
the transient failures category, according to RFC 3588 [RFC3588]
Section 10.1.3 lists the new Result-Code AVP values that fall into
the permanent failures category, according to RFC 3588 [RFC3588]
14. Security Considerations
This memo does not describe a stand-alone protocol, but a particular
application for the Diameter protocol [RFC3588]. Consequently, all
the security considerations applicable to Diameter automatically
apply to this memo. In particular, Section 13 of RFC 3588 applies to
This Diameter SIP application allows a Diameter client to use the
properties of HTTP Digest authentication [RFC2617] by evaluating or
sending to the Diameter server the credentials supplied by a user.
The discussion of HTTP Digest authentication in Section 4 of RFC 2617
[RFC2617] is also applicable to this memo.
This Diameter SIP application also allows a Diameter client to use
the properties of HTTP Digest authentication using AKA [RFC3310] by
evaluating or sending to the Diameter server the credentials supplied
by a user. Section 5 of RFC 3310 [RFC3310] is also applicable to
14.1. Final Authentication Check in the Diameter Client/SIP Server
The Diameter SIP application can be configured to operate in a
scenario where the final authentication check is performed in the
Diameter client (SIP server). There are a number of security
considerations associated to it; all of them are consequences of the
requirement to transfer H(A1) from the Diameter server to the
o Both Diameter client and server must trust each other, such as
when both client and server belong to the same administrative
o To avoid eavesdroppers, the transport protocol between the
Diameter client and server MUST be secured. RFC 3588 [RFC3588]
specifies TLS [RFC4346] and IPsec as possible transport protection
mechanisms for Diameter.
Due to these security considerations, it is RECOMMENDED to configure
the Diameter SIP application to operate in the mode where the final
authentication check is performed in the Diameter server.
The authors would like to thank the following contributors who made
substantial contributions to this work:
Pete McCann Lucent
Jaakko Rajaniemi Nokia
Wolfgang Beck (Deutsche Telekom AG) provided the text in Section 12,
"Migration from RADIUS".
The authors would like to thank Tony Johansson and Kevin Purser for
their invaluable contribution to the start-up of this application and
the continuous progress. The authors would like to thank Daniel
Warren, Jayshree Bharatia, Kuntal Chowdhury, Jari Arkko, Avi Lior,
Wolfgang Beck, Ulrich Wiehe, Cullen Jennings, Anu Leinonen, Glen
Zorn, German Blanco, Mikko Aittola, Bert Wijnen, and Sam Hartman for
their reviews and valuable comments.
The Diameter SIP application is based on the Diameter application for
the Cx interface of the 3GPP IP Multimedia Subsystem [3GPP.29.229].
The authors would like to thank 3GPP Working Group CN4 for this work.
17.1. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC2617] Franks, J., Hallam-Baker, P., Hostetler, J., Lawrence,
S., Leach, P., Luotonen, A., and L. Stewart, "HTTP
Authentication: Basic and Digest Access
Authentication", RFC 2617, June 1999.
[RFC3261] Rosenberg, J., Schulzrinne, H., Camarillo, G.,
Johnston, A., Peterson, J., Sparks, R., Handley, M.,
and E. Schooler, "SIP: Session Initiation Protocol",
RFC 3261, June 2002.
[RFC3310] Niemi, A., Arkko, J., and V. Torvinen, "Hypertext
Transfer Protocol (HTTP) Digest Authentication Using
Authentication and Key Agreement (AKA)", RFC 3310,
[RFC3588] Calhoun, P., Loughney, J., Guttman, E., Zorn, G., and
J. Arkko, "Diameter Base Protocol", RFC 3588,
[RFC4590] Sterman, B., Sadolevsky, D., Schwartz, D., Williams,
D., and W. Beck, "RADIUS Extension for Digest
Authentication", RFC 4590, July 2006.
17.2. Informative References
[RFC4346] Dierks, T. and E. Rescorla, "The Transport Layer
Security (TLS) Protocol Version 1.1", RFC 4346, April
[RFC3263] Rosenberg, J. and H. Schulzrinne, "Session Initiation
Protocol (SIP): Locating SIP Servers", RFC 3263,
[RFC3680] Rosenberg, J., "A Session Initiation Protocol (SIP)
Event Package for Registrations", RFC 3680,
[RFC3880] Lennox, J., Wu, X., and H. Schulzrinne, "Call
Processing Language (CPL): A Language for User Control
of Internet Telephony Services", RFC 3880,
[RFC4004] Calhoun, P., Johansson, T., Perkins, C., Hiller, T.,
and P. McCann, "Diameter Mobile IPv4 Application",
RFC 4004, August 2005.
[RFC4005] Calhoun, P., Zorn, G., Spence, D., and D. Mitton,
"Diameter Network Access Server Application",
RFC 4005, August 2005.
[RFC4006] Hakala, H., Mattila, L., Koskinen, J-P., Stura, M.,
and J. Loughney, "Diameter Credit-Control
Application", RFC 4006, August 2005.
[3GPP.29.229] 3GPP, "Cx and Dx interfaces based on the Diameter
protocol; Protocol details", 3GPP TS 29.229 5.12.0,
[JSR-000116] Java Community Process, "SIP Servlet API Specification
1.0 Final Release", JSR 000116, March 2003.
Miguel A. Garcia-Martin (Editor)
P.O. Box 407
NOKIA GROUP, FIN 00045
Phone: +358 50 480 4586
Via de los Poblados 13
Phone: +34 91 339 3535
Miguel A. Pallares-Lopez
Via de los Poblados 13
Phone: +34 91 339 4222
Via de los Poblados 13
Phone: +34 91 339 2680
Full Copyright Statement
Copyright (C) The IETF Trust (2006).
This document is subject to the rights, licenses and restrictions
contained in BCP 78, and except as set forth therein, the authors
retain all their rights.
This document and the information contained herein are provided on an
"AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST,
AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES,
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT
THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY
IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR
The IETF takes no position regarding the validity or scope of any
Intellectual Property Rights or other rights that might be claimed to
pertain to the implementation or use of the technology described in
this document or the extent to which any license under such rights
might or might not be available; nor does it represent that it has
made any independent effort to identify any such rights. Information
on the procedures with respect to rights in RFC documents can be
found in BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat and any
assurances of licenses to be made available, or the result of an
attempt made to obtain a general license or permission for the use of
such proprietary rights by implementers or users of this
specification can be obtained from the IETF on-line IPR repository at
The IETF invites any interested party to bring to its attention any
copyrights, patents or patent applications, or other proprietary
rights that may cover technology that may be required to implement
this standard. Please address the information to the IETF at
Funding for the RFC Editor function is currently provided by the