Re: RADIUS User-Name versus EAP Identity

[Alan DeKok <aland@deployingradius.com>]

Bernard Aboba wrote:
> So RFC 3579 does require the User-Name field and EAP-Response/Identity
> fields to be identical at the NAS originating the Access-Request.  

  Most RADIUS servers seem to enforce this.

> However, after that it is possible that RADIUS proxies will modify the
> User-Name attribute, so that by the time the RADIUS Access-Request
> arrives at the RADIUS server, the EAP-Response/Identity and User-Name
> Attribute will no longer match.

  This is causing problems in real-world pre-deployment systems.

  Maybe a solution would be to require that implementations ignore the
contents of the EAP-Response/Identity field.

  Alan DeKok.

--
to unsubscribe send a message to radiusext-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://psg.com/lists/radiusext/>