Subject: [eap] Proposed Resolution to Issue 154: Identity Response Mismatch

From: [email-masked] (Bernard Aboba)
Date: Thu, 10 Jul 2003 10:16:29 -0700 (PDT)

The text of Issue 154 (and subsequent discussion) is included below. The
proposed resolution is as follows:

In Section 7.3, add the following paragraph:

"It is possible for the identity in the identity response to be
different from the identity authenticated by the EAP method.  This may
be intentional in the case of identity privacy.   An EAP method SHOULD
use the authenticated identity when making access control decisions."

-------------------------------------------------------------------
Issue 154: Identity Response Mismatch
Submitter name: Joe Salowey
Submitter email address: [email-masked]
Date first submitted: July 6, 2003
Reference:
http://mail.frascone.com/pipermail/public/eap/2003-July/001418.html
Document: EAP-04
Comment type: T
Priority: 1
Section: 7.3
Rationale/Explanation of issue:

I could not find a place in the draft where it covers the possiblity
that the Identity response differs from the identity that is
authenticated by the EAP method.

Requested change:

Perhaps the following should be added to the security considerations
section:

"It is possible for the identity in the identity response to be
different from the identity authenticated by the EAP method.  This may
be intentional in the case of identity privacy.   An EAP method SHOULD
use the authenticated identity when making access control decisions.  A

[Jari Arkko] Fine so far...

method MAY allow the use of the identity in the identity response if it
is an authorized alias for the authenticated identity."

[Jari Arkko] This part I don't understand. Are you still talking about the
case where the id resp != some method internal identity?

[Joe Salowey] Yes, It should probably say

"If  the identity in the Identity Response is an authorized alias of the
authenticated identity the alias MAY use this identity for making access
control decisions."

Alternatively we could just say that the authenticated identity always
takes precedence over the identity in the identity response when they
differ.