Subject: Re: [radext] RFC 4282 - Correct usage when no home-realm

From: Bernard Aboba <[email-masked]>
Date: Wed, 16 Jan 2013 14:12:24 -0800

On Jan 16, 2013, at 8:30 AM, "Warne, Cheryl A." <[email-masked]> wrote:

> Sir,
>  
> I would like to verify the correct construction to use when the original NAI does not include a home-realm.
>  
> Original NAI-1: [email-masked]
> Original NAI-2: jandoe
> Routing Realm: partnermso.net
>  
> NAI-1 sent to partner: [email-masked]
> NAI-2 sent to partner:  Should it be [email-masked] or [email-masked] ?
>  
> Thank you,
>  
> Cherie Warne 
> Bright House Networks | Network Engineering and Operations
> 65 South Keller Road, Orlando, FL  32810
> 
> 
> 
>  
>  
> 
> 
> CONFIDENTIALITY NOTICE: This e-mail may contain information that is privileged, confidential or otherwise protected from disclosure. If you are not the intended recipient of this e-mail, please notify the sender immediately by return e-mail, purge it and do not disseminate or copy it.

---

From: Alan DeKok <[email-masked]>
Date: Wed, 16 Jan 2013 17:59:30 -0500

> On Jan 16, 2013, at 8:30 AM, "Warne, Cheryl A."
> <[email-masked] <mailto:[email-masked]>>
> wrote:
>>
>> I would like to verify the correct construction to use when the
>> original NAI does not include a home-realm.
>>

  I'll note that RFC 4282 does not contain the concept of a "routing
realm".  It refers to routing by realm, but is clear that the realm in
question is the realm in the NAI.

  My interpretation is that the basis for the question is largely
outside of the scope of 4282.

>>  or [email-masked] ?

  RFC 4282 doesn't describe how NAIs are re-written or modified.

  So again the question is outside of the scope of 4282.

  The updated NAI document (draft-ietf-radext-nai-01.txt) contains new
text based on existing practice and RADEXT working group input.  It
suggests that routing is based on the NAI *as seen*.  It also says
modifications as seen above wrong:

...
   Some systems have historically used NAI modifications with multiple
   "prefix" and "suffix" decorations to perform explicit routing through
   multiple proxies inside of a AAA network.  This practice is NOT
   RECOMMENDED for the following reasons:
...

  I think this question is based on a whole set of unstated assumptions.
 For example, that a "routing realm" exists (whatever that is); that the
NAI is re-written (why?); that the "routing realm" is added to the NAI
in some form; etc.

 Alan DeKok.