eap Mailing List: RE: interpretation of the identity response

[Adrangi, Farid (farid.adrangi]

Title: Message

Leaving the processing totally up to the mechanism may lead to some interoperability issues.  I like your preferred way to use the identity response for routing purposes only. 

BR,

Farid

 

-----Original Message-----
From: Joseph Salowey [mailto:jsalowey [at] cisco.com]
Sent: Wednesday, October 29, 2003 6:20 PM
To: Adrangi, Farid; 'Bernard Aboba'; jarkko [at] piuha.net
Cc: Lortz, Victor; Puthenkulam, Jose P; eap [at] frascone.com
Subject: RE: [eap] interpretation of the identity response

 

I think the processing of the identity response is up to the mechanism.  If the NAI is decorated in non-standard means that is not known to the home AAA this can be a problem (it is also not within the NAI specification). Many mechanisms have a way to request or determine identity independent of the EAP identity response (EAP-SIM,EAP-AKA,EAP-TLS,EAP-MCSHAPv2).   I If I had my preference I would use the identity response for routing only and ignore the user identity in the identity response.  It should be a recommendation that mechanisms provide a way to obtain identity outside of the identity response. 

 

Joe

-----Original Message-----
From: eap-admin [at] frascone.com [mailto:eap-admin [at] frascone.com] On Behalf Of Adrangi, Farid
Sent: Wednesday, October 29, 2003 5:53 PM
To: Bernard Aboba; jarkko [at] piuha.net
Cc: Lortz, Victor; Puthenkulam, Jose P; eap [at] frascone.com
Subject: [eap] interpretation of the identity response

Hello Bernard/Jari:

 

I have a quick question regarding 2284bis-06 draft.  Currently, the draft does not specify any rules on how the EAP server should interpret an identity response (in particular where it is indicated in NAI format) to extract the identity to be authenticated.  For example, given the following NAI Eng%nancy [at] bigu.edu,  does the EAP server use the nancy [at] bigu.edu portion or the whole string as the ID for authenticating the user?  Or another NAI example, say you have ipass/nancy [at] bigu.edu (where the ipass prefix is used to indicate the RADIUS AAA server in an Access Network how to route the RADIUS packets) will the EAP server use nancy [at] bigu.edu portion or the whole string?

 

Thanks for your time.

 

BR,

Farid