Subject: [eap] interpretation of the identity response

From: "Adrangi, Farid" <[email-masked]>
Date: Wed, 29 Oct 2003 17:53:13 -0800

Hello Bernard/Jari:

I have a quick question regarding 2284bis-06 draft.  Currently, the
draft does not specify any rules on how the EAP server should interpret
an identity response (in particular where it is indicated in NAI format)
to extract the identity to be authenticated.  For example, given the
following NAI [email-masked] <mailto:[email-masked]> ,  does
the EAP server use the [email-masked] portion or the whole string as the
ID for authenticating the user?  Or another NAI example, say you have
ipass/[email-masked] (where the ipass prefix is used to indicate the
RADIUS AAA server in an Access Network how to route the RADIUS packets)
will the EAP server use [email-masked] portion or the whole string? 

Thanks for your time.

BR,

Farid

---

From: "Joseph Salowey" <[email-masked]>
Date: Wed, 29 Oct 2003 18:19:32 -0800

I think the processing of the identity response is up to the mechanism.
If the NAI is decorated in non-standard means that is not known to the
home AAA this can be a problem (it is also not within the NAI
specification). Many mechanisms have a way to request or determine
identity independent of the EAP identity response
(EAP-SIM,EAP-AKA,EAP-TLS,EAP-MCSHAPv2).   I If I had my preference I
would use the identity response for routing only and ignore the user
identity in the identity response.  It should be a recommendation that
mechanisms provide a way to obtain identity outside of the identity
response.  
 
Joe

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf
Of Adrangi, Farid
Sent: Wednesday, October 29, 2003 5:53 PM
To: Bernard Aboba; [email-masked]
Cc: Lortz, Victor; Puthenkulam, Jose P; [email-masked]
Subject: [eap] interpretation of the identity response

Hello Bernard/Jari:

Thanks for your time.

BR,

Farid

---

From: Bernard Aboba <[email-masked]>
Date: Wed, 29 Oct 2003 18:21:07 -0800 (PST)

> mechanisms provide a way to obtain identity outside of the identity

Yes, I agree with this. A side benefit is that the Identity can be
protected.

Is there any text that needs to be added to RFC 2284bis to clarify this?
We're in IETF last call now, so I'd encourage submission of an issue...
_______________________________________________
eap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/eap

---

From: John Vollbrecht <[email-masked]>
Date: Wed, 29 Oct 2003 22:23:48 -0500

> mechanisms provide a way to obtain identity outside of the identity
I agree with your suggestion about independent identity in a method.  I am 
wondering if the question about format is not also valid for routing.  If 
the identity response is used for routing, then it must be understood by 
all routers.  If a NAS or Proxy gets something it doesn't understand how to 
route it presumably throws it away or sends a Failure.  The implication is 
that the Client and NAS and any intermediate servers need to have the same 
routing expectations.

The spec does not say anything about how to break up the NAI for routing.
I think it is pretty complicated to come up with an agreement about what 
such a standard would be, and I personally don't think it is necessary at 
this point.

-- John
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Adrangi, Farid Sent: Wednesday, October 29, 2003 5:53 PM
> I have a quick question regarding 2284bis-06 draft.  Currently, the draft
> does not specify any rules on how the EAP server should interpret an
> identity response (in particular where it is indicated in NAI format) to
> extract the identity to be authenticated.  For example, given the
> following NAI [email-masked],  does the EAP server use the
> [email-masked] portion or the whole string as the ID for authenticating
> the user?  Or another NAI example, say you have ipass/[email-masked]
> (where the ipass prefix is used to indicate the RADIUS AAA server in an
> Access Network how to route the RADIUS packets) will the EAP server use
> [email-masked] portion or the whole string?
>
>
>
> Thanks for your time.
>
>
>
> BR,
>
> Farid
>
>
>