Subject: RE: (radius) More detail on Proxy

From: "Nelson, David" <[email-masked]>
Date: Wed, 3 Mar 1999 10:26:03 -0500

Steven Crain writes...

> This could be misleading.  In my operation, different customers have
> password entries on different hosts.  E.g.
> 
> User                    Host
> [email-masked]      apple
> [email-masked]         orange
> [email-masked]        apple
> [email-masked]         orange
> [email-masked]		radius.another.net
> 
> The choice of remote server in our case is based on looking 
> up the host associated with the whole User-Name, not some
> portion of it.
> 
> I would change "A realm can either be based on part of the 
> User-Name" to "A realm can either be based on all or part of
> the User-Name."

While I wouldn't want to absolutely prohibit the behavior that
you have implemented (for reasons important to your business),
I certainly wouldn't want to encourage the RADIUS community at
large to follow your lead.

You have essentially created a flat name space.  That, IMHO,
doesn't scale well.  I think that a hierarchical name space,
where the realm part is akin to the FQDN part in an SMTP
address is much more scalable.  I note that other large scale,
distributed authentication systems such as Kerberos do parse
the realm part separately from the username part.  I suggest
that this be the recommended practice for RADIUS proxy as well.

Regards,

Dave 

David B. Nelson                          Cabletron Systems, Inc.
Software Engineer V                      50 Minuteman Road
(978) 684-1330                           Andover, MA 01810

-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.

---

From: "Steven P. Crain" <[email-masked]>
Date: Wed, 3 Mar 1999 15:53:09 -0500 (EST)

> that this be the recommended practice for RADIUS proxy as well.

What you say makes perfect sense in the context of roaming, but proxying
is not only used for roaming.  We use it to load balance customers over
more than shell host, without the sometimes clueless users necessarily
needing to remember when they log in which host their account is on.

Users want a complete virtual domain.  They bought clueless.com, and they
want to use it for everything.  Thier email is sent to [email-masked],
and it is really delivered to [email-masked].  Someone visits
www.clueless.com and get a vhost running on www13.isp.net.  They also want
to log in using [email-masked], not [email-masked].  The RADIUS
proxy server needs to support flat per-user proxying for our own customers
([email-masked]>[email-masked]) and more traditional per-realm
proxying for anything not specifically defined for roaming.

-- 
Steven P. Crain, Development
http://www.shore.net/~scrain
Shore.Net: Local Ties... World Class Connections

-