Subject: RADIUS Errata #1407 (RFC 5176)

From: Bernard Aboba <[email-masked]>
Date: Mon, 7 Sep 2009 11:34:55 -0700

My recommendation is that this errata be accepted.  As Avi points out, 
the CUI attribute is opaque and therefore not parseable by the Dynamic
Authorization Server. 

Status: Reported

Type: Technical

Reported By: Avi Lior

Date Reported: 2008-04-09

Section 6.1 says:

Typically, the Dynamic Authorization Server will extract the realm
   from the Network Access Identifier [RFC4282] included within the
   User-Name or Chargeable-User-Identity Attribute, and determine the
   corresponding RADIUS servers in the realm routing tables.

It should say:

Typically, the Dynamic Authorization Server will extract the realm
   from the Network Access Identifier [RFC4282] included within the
   User-Name and determine the
   corresponding RADIUS servers in the realm routing tables.

Notes:

Chargeable-User-Identity Attribute defined in RFC4372 does not allow
any entity other then the home network to parse the CUI attribute. It
is in essence opaque. Here is the text:

"RADIUS entities other than the Home RADIUS

      server MUST treat the CUI content as an opaque token, and SHOULD

      NOT perform operations on its content other than a binary equality

      comparison test, between two instances of CUI."

 EMAILING FOR THE GREATER GOOD
Join me

---

From: Alan DeKok <[email-masked]>
Date: Tue, 08 Sep 2009 16:59:31 +0200

Bernard Aboba wrote:
> *My recommendation is that this errata be accepted.  As Avi points out,

  I agree.

  Alan DeKok.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://psg.com/lists/radiusext/>