Subject: [eap] Issue 39: When can an Identity Request be sent?

From: [email-masked] (Bernard Aboba)
Date: Wed, 9 Oct 2002 08:28:30 -0700 (PDT)

Issue 39: When can an Identity Request be sent?
Submitter: Bernard Aboba
Submitter email address: [email-masked]
Date first submitted: October 9, 2002
Reference:
Document: RFC2284bis-06
Comment type: T
Priority: S
Section:  5.1

Rationale/Explanation of issue:

>From Jari's position paper:

"- Identity request:  In theory one might
think of a method that requires a second identity
to be sent during its progress. However, I think
this would complicate the protocol too much. Let's
just forbid identity request in all other states than
Unauthenticated."

Change:

"   The Identity Type is used to query the identity of the peer.  The
   Authenticator will typically issue this as the initial Request.  An
   optional displayable message MAY be included to prompt the Peer in
   the case where there is an expectation of interaction with a user.  A
   Response MUST be sent to this Request with a Type of 1 (Identity)."
To:

" The Identity Type is used to query the identity of the peer. The
Authenticator will typically issue this as the initial Request; an
Identity Request MUST NOT be sent in the middle of a method, although
it could be sent multiple times within a sequence of methods. An
optional displayable message MAY be included to prompt the Peer in
the case where there is an expectation of interaction with a user. A
Response MUST be sent to this Request with a Type of 1 (Identity).
A peer MUST NOT respond to an Identity Request with a NAK.

A method resident on the authenticator can be assumed to have access
to the Identity Response returned by the peer, even though that
message is not directed to the method. Since the Identity Request is
often sent automatically by the authenticator, the Identity method
may be thought of as residing within the EAP layer. Where the Identity
Request is not sent automatically, there SHOULD be a way for a method
to request that the Identity Request be sent, in case no method-specific
identity request is available, and a claim of identity is required by
the method.

Sending an Identity Request is optional on the authenticator, and
implementations SHOULD provide a way to configure the authenticator
so that Identity Requests are not sent."