Subject: (radius) Proxy Snares

From: Carl Rigney <[email-masked]>
Date: Thu, 25 Feb 1999 10:06:41 -0800 (PST)

Sorry, I should have asked for input on this previously, instead of at
the last moment like this, but I'm very interested in hearing from
anyone who's implemented RADIUS proxy about anything they found hard to
understand in RFC 2138 and 2139, and especially anything that wasn't
stated in the drafts, but whose implications caused them grief in
implementation that could have been saved if someone had sad "and don't
forget to think about <X> when doing proxy."

Email on the topic today would be most helpful, but even if you don't have
time now (or are reading this next week due to the list volume :-) ) I'd
be very interested in hearing your thoughts.

--
Carl
-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.

---

From: "Steven P. Crain" <[email-masked]>
Date: Thu, 25 Feb 1999 13:51:59 -0500 (EST)

> be very interested in hearing your thoughts.

I haven't implemented RADIUS proxy, but I would like to respond as a user
of a proxy implementation.

We have had difficulty in providing roaming services to other companies
because many of the proxy implementations do not provide a mechanism for
controlling what attributes/values can be present in responses they relay
to the client.

With many proxies, they would happily pass Framed-IP-Address =
149.198.247.6 and then noone would locally be able to get to
www.livingston.com :-!

I recommend language something like "Proxy implementations SHOULD exercize
reasonable administrative control over responses they relay."

-- 
Steven P. Crain, Development
http://www.shore.net/~scrain
Shore.Net: Local Ties... World Class Connections

-