Re: [radext] Review of draft-winter-radext-populating-eapidentity-01

[Bernard Aboba <[e-mail]>]

On Jul 21, 2015, at 21:22, Stefan Winter <[e-mail]> wrote:
> 
> The Win 7 PEAP config allows to configure the method inner identity.
> There's also a separate place for the outer identity.
> However: you can't type a NAI realm in the outer ID box, only a non-NAI
> string.
> 
> What happens when you type "anonymous" as outer ID, and
> "[e-mail]" as the inner ID, is that the supplicant will send an
> EAP-Response/Identity of "[e-mail]".

[BA] That is bad behavior for sure in both cases. 

> That is, the config options for inner vs. outer are different, yet
> related. The supplicant blends two different config items into one
> resulting string. Hopefully, both are in the same encoding, and
> hopefully, the encoding is UTF-8.

[BA] As they say, "hope is not a strategy". 

> The draft's intention is exactly to move implementations towards UTF-8
> for the EAP-Response/Identity *no matter where they take the string
> from,

[BA] that is a fine goal, well supported by RFC 3748.

> be it from an inner identity, explicit configuration of an outer
> identity, or a blend of the two*. It is not the intention to spill inner
> identities to EAP-Response/Identity if an outer identity is configured.

[BA] Blending the two does not seem like a practice to be encouraged, nor do I recall any one else doing something like that. So pointing at out the potential ill effects as well as the right thing to do seems appropriate.