Re: [radext] Review of draft-winter-radext-populating-eapidentity-01

[Sam Hartman <[e-mail]>]

>>>>> "Bernard" == Bernard Aboba <[e-mail]> writes:

    Bernard>    One of the fundamental assumptions of this document is
    Bernard> that the EAP-Response/Identity is somehow determined from
    Bernard> the method-specific identities.  This is not correct, as
    Bernard> RFC 3748 Section 5.1 makes clear:

Hi.  I was very confused to read this paragraph, because we've discussed
this issue several times and I think we're all in agreement that the
method-specific identities are not directly related to the eap
response/identity.  I think that as the text you cite from RFC 3748
points out, the EAP response is often used for routing, so in many
deployments there is some relation.

I stopped reading your review after this first paragraph, because I
think that this disconnect colors the entire review.  I'd really
appreciate it if you would explain why you think the document is
assuming that the eap-response/identity is determined from method
identities.
I know that was not our intent.

I do think it's true that implementations sometimes derive both the eap
response/identity and the method-specific identities from a common
principal.
Other implementations request both identities from the user.
However, I don't know anything that tries to map back from a method
identity to an eap response.

--Sam