Subject: RE: [eap] Proposed Resolution to Issue 311: EAP and Authorization

From: "Salowey, Joe" <[email-masked]>
Date: Sun, 15 Jan 2006 19:10:12 -0800

> -----Original Message-----
> From: Bernard Aboba [mailto:[email-masked]] 
> Sent: Sunday, January 08, 2006 10:27 AM
> To: [email-masked]
> Subject: [eap] Proposed Resolution to Issue 311: EAP and Authorization
> 
> The text of Issue 311 is available here:
> http://www.drizzle.com/~aboba/EAP/eapissues3.html#Issue%20311
> 
> The proposed resolution is as follows:
> 
> In Section 1.3, change:
> 
> "  The EAP server also
>    stores the peer's identity and/or other information necessary to
>    decide whether access to some service should be granted.  The peer
>    stores information necessary to choose which secret to use 
> for which
>    service.
> 
>    If authentication is based on proof of possession of the 
> private key
>    corresponding to the public key contained within a certificate, the
>    parties store the EAP method to be used and the trust 
> anchors used to
>    validate the certificates.  The EAP server also stores the peer's
>    identity and/or other information necessary to decide 
> whether access
>    to some service should be granted.  The peer stores information
>    necessary to choose which certificate to use for which service."
> 
> To:
> 
> "The EAP server also stores the peer's identity as well as 
> other information
> associated with it. This information may be used to determine 
> whether access
> to some service should be granted. The peer
> stores information necessary to choose which secret to use for which
> service.
> 
> If authentication is based on proof of possession of the private key
> corresponding to the public key contained within a certificate, the
> parties store the EAP method to be used and the trust anchors used to
> validate the certificates.  The EAP server also stores the peer's
> identity 

[Joe] why is it necessary that the EAP server store the peer's identity
in this case? 

> and the peer stores information
> necessary to choose which certificate to use for which service."
> 
> 
> _________________________________________________________________
> To unsubscribe or modify your subscription options, please visit:
> http://lists.frascone.com/mailman/listinfo/eap
> 
> Arhives: http://lists.frascone.com/pipermail/eap
> 
_________________________________________________________________
To unsubscribe or modify your subscription options, please visit:
http://lists.frascone.com/mailman/listinfo/eap

Arhives: http://lists.frascone.com/pipermail/eap

---

From: "Bernard Aboba" <[email-masked]>
Date: Mon, 16 Jan 2006 18:44:35 -0800

[BA] I guess to associate it with the authorizations.  The peer identity is
included in the certificate altSubjectName, so it isn't needed for other
reasons.  Is there a way to make that more clear?