Re: [radext] I-D Action: draft-ietf-radext-nai-02.txt

["Jim Schaad" <[e-mail]>]

Sam,

In the descriptive text that Stefan provided, he said that the AAA client
was configured with the fact that the names were the same.  Thus there is no
reason for it not to do the mapping on that information rather than
normalization.

If we are talking about delaying the normalization, then we are looking at
what the AAA client as oppose to the AAA server is looking for in the
un-normalized name.   AAA proxies are always going to want to see the
normalized version of the name.  

There may be other issues in non-AAA systems, but again we are looking at
three different entities, the initial client, any proxies in the middle and
the final destination server.  We are imposing work on the middle proxies in
order to get something that is not necessarily a strong benefit for the
final server.

Jim


> -----Original Message-----
> From: Sam Hartman [mailto:[e-mail]]
> Sent: Monday, March 18, 2013 10:22 AM
> To: Jim Schaad
> Cc: 'Stefan Winter'; [e-mail]
> Subject: Re: [radext] I-D Action: draft-ietf-radext-nai-02.txt
> 
> >>>>> "Jim" == Jim Schaad <[e-mail]> writes:
> 
>     Jim> I would not support this change.  I would suggest that in this
>     Jim> case that the AAA client should be the one that does the
>     Jim> required normalization or mapping into the normal form as part
>     Jim> of its "I know where this is supposed to be going" work.
> 
>     Jim> I don't see any reason to impose this onto the middle proxies
>     Jim> rather than the injecting system.
> 
> We have a lot of experience in the i18n space that suggests you're much
> better off normalizing as late as possible.  When you normalize at
injection
> you can lose information and collapse things together that a later party
may
> wish you had not.  The person using the information is in a much better
> position to know what options they need to distinguish between and thus is
in
> a better position to know what normalization is appropriate.
> 
> The major exceptions to this rule are when you're forced to normalize
before
> hashing/encrypting or when you have a legacy system like the DNS.
> 
> --Sam