Subject: [radext] [Errata Verified] RFC7542 (5462)

From: RFC Errata System <[email-masked]>
Date: Wed, 11 Dec 2019 14:23:20 -0800 (PST)

The following errata report has been verified for RFC7542,
"The Network Access Identifier". 

--------------------------------------
You may review the report below and at:
https://www.rfc-editor.org/errata/eid5462

--------------------------------------
Status: Verified
Type: Technical

Reported by: Alan DeKok <[email-masked]>
Date Reported: 2018-08-14
Verified by: Benjamin Kaduk (IESG)

Section: 3

Original Text
-------------
The "utf8-realm" SHOULD be supplied by the "next hop" or "home"
system that also supplies the routing information necessary for
packets to reach the next hop.

Corrected Text
--------------
The "utf8-realm" SHOULD be supplied by the "next hop" or "home"
system that also supplies the routing information necessary for
packets to reach the next hop.

The final home system SHOULD validate the NAI in the received packet
against the list of Realms hosted by the home system.  If no match
is found, the request SHOULD be rejected.

Notes
-----
It doesn't explicitly say that home systems only authenticate users for their own realms.  It may help to have this stated explicitly.

Some text will also be added to draft-ietf-radext-coa-proxy in order to make this clearer.

--------------------------------------
RFC7542 (draft-ietf-radext-nai-15)
--------------------------------------
Title               : The Network Access Identifier
Publication Date    : May 2015
Author(s)           : A. DeKok
Category            : PROPOSED STANDARD
Source              : RADIUS EXTensions
Area                : Operations and Management
Stream              : IETF
Verifying Party     : IESG