Subject: [eap] User-Name in EAP/RADIUS - String?

From: [email-masked] (tom bonacci)
Date: Fri, 12 Apr 2002 18:29:55 -0600

Please help clear up an ambiguity:

from RFC 2869:
> In order to permit non-EAP aware RADIUS proxies to forward the
> Access-Request packet, if the NAS sends the EAP-Request/Identity, the
> NAS MUST copy the contents of the EAP-Response/Identity into the
> User-Name attribute and MUST include the EAP-Response/Identity in the
> User-Name attribute in every subsequent Access-Request.

1) Is the EAP-Response/Identity (as concerns 2869), which is required to
be placed into the User-Name attribute, the entire EAP-Response/Identity
packet including Code, Identifier, Length, Type, and Type-Data or is it
simply the Type-Data?  (If the latter is true, 2869 might more carefully
have been written: "...the NAS MUST copy the contents of Type-Data from
the EAP-Response/Identity packet into the User-Name attribute...")

2) RFC 2865 defines the User-Name attribute to be the triple: 
>  User-Name (0x01), Length (>3), and String... 
RFC 2284 makes no demands upon the contents of Type-Data contained in an
EAP-Response/Identity.  RFC 2284 would seem to allow any data, including
embedded 0x00's (and, in fact, this might be thought useful by some EAP
authentication schemes).  Does EAP interoperation with RADIUS, as
defined in 2869, presuppose that the contents of Type-Data within an
EAP-Response/Identity packet be somewhat well-behaved (i.e. - a
reasonable string)?

Thanks for any responses.

regards,
Tom Bonacci
Lucent Technologies/Bell Labs Innovations