[radext] Review of draft-ietf-radext-nai-03

[Bernard Aboba <[e-mail]>]

While the document now seems to recognize reality in several places, the recognition has not reflected itself uniformly in the normative statements.  So, overall, the draft contradicts itself in multiple places. 
 
For example, the document recognizes that existing network access client implementations don't normalize the NAI (e.g. don't use NFC), so that normalization by a AAA proxy MAY be required.  
 
At the same time, it insists that byte-by-byte comparisons be done on NAI realms. 
 
Those two points of view aren't compatible with each other.   If we can't rely on normalization by clients or NAS devices then AAA proxies doing realm comparisons need to do normalization first or the comparisons won't be reliable.   
 
Another contradiction relates to the format of user identifiers used in non-network access protocols like SIP and HTTP. 
 
The document admits that they could use escaping, and won't normalize the NAI as recommended prior to sending it. 
 
This of course implies that the escaped characters need to be converted prior to comparison, which the document does note.  
 
But this contradicts the byte-by-byte comparison statements (as well as the "normalize before sending" statement).  
 
It also seems to contradict the "use NAI in other protocols" recommendation, since we can't have an expectation that all protocols using AAA will have user identities that conform to the NAI. 
 
Overall, my suggestion is that the document needs to re-think the approach. 
 
While it is OK to require the NAI to be provided in UTF-8 form,  normalization via NFC is so uncommon that requiring it to occur on the end host does not pass the smell test. 
 
Since it is unlikely that network access clients or NAS devices will change their behavior, it seems to me that AAA proxies making realm comparisons (e.g. for realm routing) need to be prepared to normalize the realms first.  The steps involved in doing this should be described in the document. 
 
Also, while I don't disagree with the statements made about "NAI decoration" the term "deprecation" isn't explicitly used, though that seems clearly to be what is meant.  So if we are really trying to put the decoration practice to bed, we should say so (like obsoleting the relevant documents).