[radext] Re: Review of draft-janfred-radext-radius-congestion-control-01

[Alan DeKok <[e-mail]>]

On Apr 23, 2026, at 10:12 AM, Michael Richardson <[e-mail]> wrote:
> But, AFAIK, federations like eduroam leaves it up to the supplicant and
> backend authenticator to do whatever inner EAP method they want.  So the
> authenticator does not get to see that part, so can't do any kind of per-user
> rate limiting.  All that is visible is the outer EAP's NAI.

  Yes.

> This seems like a big deal, and something worth fixing, even if it takes a
> long time to deploy.

  There as similar issues with EAP-PPT.

  When a user has complete anonymity in a roaming environment, there is substantial potential for abuse.

  It's likely impossible to satisfy both the user desire for anonymity, and the local administrations desire to prevent abuse.

  So the question then becomes, what can we do about it?

  I suspect that administrators will err on the side of safety.  i.e. If someone @example.com is abusing the local network. the safest and simplest thing to do is to ban all users @example.com.

  Those users can then complain to their administrator, who will (presumably) deal with the issue out of band.

  Alan DeKok.