Subject: [eap] Issue 142: Contents of the EAP-Request/Identity

From: [email-masked] (Bernard Aboba)
Date: Tue, 10 Jun 2003 23:15:44 -0700 (PDT)

Submitter name: Tim Moore
Submitter email address: [email-masked]
Date first submitted: June 9, 2003
Reference:
Document: EAP-03
Comment type: T
Priority: S
Section: 5.1
Rationale/Explanation of issue:

Change:

" This field MAY contain a displayable message in the Request,
containing UTF-8 encoded ISO 10646 characters [RFC2279]. The
Response uses this field to return the Identity. If the Identity
is unknown, this field should be zero bytes in length. The field
MUST NOT be null terminated. The length of this field is derived
from the Length field of the Request/Response packet and hence a
null is not required."

To:

" This field MAY contain a displayable message in the Request,
containing UTF-8 encoded ISO 10646 characters [RFC2279]. Where
the Request contains a null, only the portion of the field preceeding
the null is displayed, with the rest used as a hint to the
peer as to the identity to be provided in the Response, as described
in Appendix A.2. If the Identity is unknown, the Identity Response
field should be zero bytes in length. The Identity Response field
MUST NOT be null terminated. In all cases, the length of the
Type-Data field is derived from the Length field of the
Request/Response packet."

Add to Appendix A:

"A.2 Contents of the Request/Identity Type-Data field

So as to provide the peer with a hint as to the appropriate identity to
place in the Type-Data field of the EAP-Response/Identity, the
authenticator may wish to identity itself EAP-Request/Identity, in
addition to providing a displayable message to the peer, such as an
Appropriate Use Policy (AUP).

The following format is proposed for the null-terminated displayable
string and the comma-separated portion of the EAP-Request/Identity message
string:

<display-string>\0networkid=<network-name>,nasid=<nas-name>,portid=<port-id>

Where:

network-name: Name of the network to which the authenticator connects.
              This is typically the SSID for IEEE 802.11.

nas-name: Name or address of the NAS.

port-id: port that the EAP session is on.

The EAP peer should display display-string before the null termination
(\0) to enable administrators to display network identification messages
or appropriate use policies (AUPs)."