Re: [radext] Review of draft-winter-radext-populating-eapidentity-01

>>>>> "Bernard" == Bernard Aboba <bernard_aboba@hotmail.com> writes:

    Bernard>    [BA] Having valid outer config would help too.

    Bernard>      Encoding (as in: to UTF-8) should always be possible
    Bernard> (the EAP peer hopefully knows the original
    Bernard> encoding). Again, if the resulting string is not a NAI but
    Bernard> a NAI would be needed to route the authentication - time to
    Bernard> give up.

    Bernard>    [BA] The EAP implementation needs to provide an NAI for
    Bernard> the outer identity because the standard requires it. No
    Bernard> need to sugar code it - not doing so is broken.
    Bernard> _______________________________________________ radext
    Bernard> mailing list radext@ietf.org
    Bernard> https://www.ietf.org/mailman/listinfo/radext

I agree that the implementation MUST provide an outer identity.
I do want to permit mapping from some common idea of an account.
Especially for things like RFC 7055 where you're integrating EAP into
something else, you may only have space in the involved APIs for a
single concept of identity.
There you almost certainly want to do a privacy-based outer ID, and
you'll need to have specific knowledge of the methods you use, and there
may be some configurations you don't work with.
It's not fully general, but it is more intuitive than an iterface that
prompts for a lot of identities.

ONe thing to clarify in this document is which identities are we talking
about.  There are:

* The outer identity carried in an EAP response in RADIUS/Diameter.  I
  know we're talking about that one.  That's the primary point of the
  document.

* The Inner identity (if you have a tunnel method) often carried in an
  EAP response/identity in the tunnel.  You could argue this one is
  either in or out of scope.  You could argue this is an internal
  identifier of the tunnel method.

* The method specific identifier of the EAP method within the tunnel.
  In case of password authentication in something like TEAP this
  identity may be carried and the classic inner identity may not.  I
  think this identity is clearly out of scope for this document.

--Sam