Subject: [eap] Issue: Identity Response mismatch

From: [email-masked] (Joseph Salowey)
Date: Sun, 6 Jul 2003 21:57:11 -0700

Submitter name: Joe Salowey
Submitter email address: [email-masked] 
Date first submitted: 7/6/2003 
Reference: 
Document: RFC2284bis, RFC 2869bis
Comment type: 'E' 
Priority: '1' 
Section: 7.3
Rationale/Explanation of issue: 

I could not find a place in the draft where it covers the possiblity
that the Identity response differs from the identity that is
authenticated by the EAP method.  

Requested change: 

Perhaps the following should be added to the security considerations
section:

"It is possible for the identity in the identity response to be
different from the identity authenticated by the EAP method.  This may
be intentional in the case of identity privacy.   An EAP method SHOULD
use the authenticated identity when making access control decisions.  A
method MAY allow the use of the identity in the identity response if it
is an authnorized alias for the authenticated identity."

---

From: [email-masked] (Jari Arkko)
Date: Mon, 07 Jul 2003 10:44:40 +0300

> use the authenticated identity when making access control decisions.  A

Fine so far...

> is an authnorized alias for the authenticated identity."

This part I don't understand. Are you still talking about the case
where the id resp != some method internal identity?

--Jari

---

From: [email-masked] (Joseph Salowey)
Date: Mon, 7 Jul 2003 09:01:59 -0700

> -----Original Message-----
> From: Jari Arkko [mailto:[email-masked]] 
> Sent: Monday, July 07, 2003 12:45 AM
> To: Joseph Salowey
> Cc: 'EAP mailing List'
> Subject: Re: [eap] Issue: Identity Response mismatch
> 
> 
> Joseph Salowey wrote:
> 
> > use the authenticated identity when making access control 
> decisions.  
> > A
> 
> Fine so far...
> 
> > method MAY allow the use of the identity in the identity 
> response if 
> > it is an authnorized alias for the authenticated identity."
> 
> This part I don't understand. Are you still talking about the 
> case where the id resp != some method internal identity?

[Joe] Yes, It should probably say

If a the identity in the identity response is an authorized alias of the
authenticated identity the alias MAY use this identity for making access
control decisions. 

Alternatively we could just say that the authenticated identity always
takes precedence over the identity in the identity response when they
differ.

---

From: [email-masked] (Jari Arkko)
Date: Mon, 07 Jul 2003 20:33:20 +0300

> authenticated identity the alias MAY use this identity for making access

Hmm... if its an alias, there does not appear to be much of
a difference, or?

> takes precedence over the identity in the identity response when they

This sounds good.

--Jari

---

From: [email-masked] (John Vollbrecht)
Date: Tue, 08 Jul 2003 18:08:19 -0400

This seems good to me

--On Sunday, July 6, 2003 9:57 PM -0700 Joseph Salowey <[email-masked]> 
wrote:

> _______________________________________________
> eap mailing list
> [email-masked]
> http://mail.frascone.com/mailman/listinfo/eap
>

---

From: [email-masked] (Joseph Salowey)
Date: Tue, 8 Jul 2003 15:34:57 -0700

After thinking about this more I think it may be more appropriate to
specify the exact behavior in the mechanism specifications.  Perhaps we
should note that for some mechanisms the authenticated identity and the
identity in the identity response may not be the same.  

> Sent: Monday, July 07, 2003 10:33 AM
> To: Joseph Salowey
> Cc: 'EAP mailing List'
> > If a the identity in the identity response is an authorized 
> alias of 
> > the authenticated identity the alias MAY use this identity 
> for making 
> > access control decisions.
>

---

From: [email-masked] (Jari Arkko)
Date: Wed, 09 Jul 2003 02:11:54 +0300

> identity in the identity response may not be the same.  

Ok.

--Jari