Subject: [radext] I-D Action: draft-ietf-radext-nai-07.txt

From: [email-masked]
Date: Tue, 23 Sep 2014 16:21:50 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the RADIUS EXTensions Working Group of the IETF.

        Title           : The Network Access Identifier
        Author          : Alan DeKok
	Filename        : draft-ietf-radext-nai-07.txt
	Pages           : 25
	Date            : 2014-09-23

Abstract:
   In order to provide inter-domain authentication services, it is
   necessary to have a standardized method that domains can use to
   identify each other's users.  This document defines the syntax for
   the Network Access Identifier (NAI), the user identity submitted by
   the client prior to accessing network resources. This document is a
   revised version of RFC 4282, which addresses issues with
   international character sets, as well as a number of other
   corrections to the previous document.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-radext-nai/

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-radext-nai-07

A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=draft-ietf-radext-nai-07

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Alan DeKok <[email-masked]>
Date: Tue, 23 Sep 2014 20:31:20 -0400

I believe this revision addresses all open concerns.  Maybe we could
do a last call before the next meeting?

[email-masked] wrote:
> _______________________________________________
> radext mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/radext

---

From: Bernard Aboba <[email-masked]>
Date: Tue, 23 Sep 2014 22:07:10 -0700

I would not say that the revision addresses all concerns.   Some of the advice is quite brittle: 
   For example, much of the common realm routing can be done on the
   "utf8-realm" portion of NAI, through simple checks for equality.
   This routing can be done even if the AAA proxy is unaware of
   internalized domain names.  All that is required is for the AAA proxy
   to be able to enter, store, and compare 8-bit data.
Realm routing based on 8-bit data comparisons has never worked reliably, since it fails even with latin character sets given inconsistent capitalization, let alone when international character sets are used.  Given that normalization on the end system is not common today, blessing 8-bit comparisons for realm routing is a bad idea - since if followed it would be likely to result in continuing problems with routing of internationalized realms. 
In this particular case, there are more reliable ways to do the comparison that should be discussed. 

> Date: Tue, 23 Sep 2014 20:31:20 -0400
> From: [email-masked]
> To: [email-masked]
> Subject: Re: [radext] I-D Action: draft-ietf-radext-nai-07.txt
>

---

From: Bernard Aboba <[email-masked]>
Date: Tue, 23 Sep 2014 22:21:51 -0700

BTW, I realize that there is better advise elsewhere in the draft... but given that, the paragraph below really is superfluous. 

From: [email-masked]
To: [email-masked]; [email-masked]
Date: Tue, 23 Sep 2014 22:07:10 -0700
Subject: Re: [radext] I-D Action: draft-ietf-radext-nai-07.txt

---

From: Alan DeKok <[email-masked]>
Date: Wed, 24 Sep 2014 09:07:13 -0400

Bernard Aboba wrote:
> BTW, I realize that there is better advise elsewhere in the draft... but
> given that, the paragraph below really is superfluous. 

  I'll remove it and re-issue the draft.  If that's the only comment,
I'm hopeful for publication...

  Alan DeKok.