RE: Issue 37: Merging of Filter Attributes

["Nelson, David" <dnelson@enterasys.com>]

Bernard Aboba writes...

> RFC 2865 doesn't have much to say on this subject, other than that 
> zero or more instances of Filter-Id can be included in an 
> Access-Accept.

That is why this subject might be fodder for the Issues and Fixes
document.  To clarify, or at least highlight, an inadequate
specification in RFC 2865 of what to do with multiple instances of
Filter-ID.

> In my experience, implementations merge the filters in the order 
> they are specified.  But perhaps there are implementations that do 
> not do this?

We have implementations that treat multiple instances as Filter-ID as
alternative filters, rather than cumulative filters.  The first
Filter-ID attribute having a name matching a locally defined filter is
used.  The remaining ones are ignored.

In the absence of guidance to the contrary, this is a permissible
interpretation, and I presume there might be others.



--
to unsubscribe send a message to radiusext-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://psg.com/lists/radiusext/>