Re: [radext] Extended IDs

I have seen some comments about the draft-chen proposal has the potential of
leaking the extended-ID by the proxy server.

First of all, if an implementation has bugs or the configuration is mishandled,
then we need have ways to debug and troubleshoot. Being an attribute gives
explicitly ways for debugging; An implementation should also have instrustment
for better debug in radius programs.

Second, similar to some types of attributes, a proxy can be configured to
explicitly filter them out (Filter Radius Attributes). If we are arguing we can
not rely on the proxy to filter them out, since there might be bugs or
misconfiguration, thus we should not even allow those attributes in radius
packets, that logic does not sound reasonable;

Third, if assume an operation completely messed up, and leaking this
extended-ID towards the home-server, I still need to see a good example
on what the harm is that, and why this can not be debugged. The draft
I agree needs to add some text on various cases and how to debug
those in each of them.

Best Regards,
- Naiming

> On Dec 12, 2017, at 12:39 PM, Adam Bishop <Adam.Bishop@jisc.ac.uk> wrote:
> 
> On 28 Nov 2017, at 13:54, Stefan Winter <stefan.winter@restena.lu> wrote:
>> In your reply to this call for adoption, please indicate which of the
>> two drafts you think should be adopted. You can of course also indicate
>> that none of the two are fit for purpose. The only thing you really
>> shouldn't do is to vote for both; that wouldn't help the discussion move on.
> 
> Having read both drafts, I think the approach in draft-dekok is more suitable for adoption.
> 
> While assigning additional meaning to existing values can be problematic, there is sufficient explanation already present in the draft to reassure me that this shouldn’t interact negatively with existing implementations, and avoids changing or extending the header.
> 
> I agree with the observation that draft-chen could be problematic in federated deployments due to the potential for the identifier to leak between hops.
> 
> Regards,
> 
> Adam Bishop
> 
>  gpg: E75B 1F92 6407 DFDF 9F1C  BF10 C993 2504 6609 D460
> 
> jisc.ac.uk
> 
> Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.
> 
> Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 2881024, VAT number GB 197 0632 86. The registered office is: One Castle Park, Tower Hill, Bristol BS2 0JA. T 0203 697 5800.  
> _______________________________________________
> radext mailing list
> radext@ietf.org
> https://www.ietf.org/mailman/listinfo/radext