Re: [radext] Review of draft-winter-radext-populating-eapidentity-01

[Sam Hartman <[e-mail]>]

>>>>> "Bernard" == Bernard Aboba <[e-mail]> writes:

    Bernard> On Jul 20, 2015, at 13:29, Sam Hartman <[e-mail]> wrote:
    >> Other implementations request both identities from the user.
    >> However, I don't know anything that tries to map back from a
    >> method identity to an eap response.

    Bernard> [BA] Neither do I - it's a bad idea.  That's why Section
    Bernard> 4's advice seems so strange:

    Bernard>     If an EAP authentication gets rejected, the EAP peer
    Bernard> SHOULD re-try the authentication using a different
    Bernard> EAP-Response/Identity than before.  The EAP peer SHOULD try
    Bernard> all user identifiers from the entire set of configured EAP
    Bernard> types before declaring final authentication failure.

    Bernard> [BA] "all user identities" appears to imply using
    Bernard> method-specific identities to construct the
    Bernard> EAP-Response/Identity.

Ah, that's not how I read it at all.
I read that as saying that you try all the identities you have.
If you're an implementation that stores outer identities separately from
inner identities, then try all your outer identities.
If you're an implementation that maps both from a common principal, do
that for all your principals.


    Bernard>    EAP peers need to maintain state on the encoding of the
    Bernard> user identifiers which are used in their locally configured
    Bernard> EAP types.  When constructing an EAP-Response/Identity from
    Bernard> that user identifier,

    Bernard> [BA] Again, this seems to imply using method-specific
    Bernard> identities to construct the EAP-Response/Identity.

I see what you're saying now.
I think what the text is trying to talk about there is constructing both
from some common principal/idea about an account.  However it could be
read as constructing one from another.
And also, it doesn't deal as well with the case where they are separate.