Policy lookups are selected by Authenticator based on Authorization information received from AAA server after successful Authentication. The AAA sever uses an attribute(radius) to send a reference to the Authorization information specific for the specific client.The Authenticator need not know the EAP identitity of the client, if it is different from IKE identity.
The Authenticator requires to know the EAP identity only if it implements the AAA server functionality. ns murthy -----Original Message----- From: ipsec-boun...@ietf.org [mailto:ipsec-boun...@ietf.org] On Behalf Of Tero Kivinen Sent: Thursday, November 12, 2009 5:01 AM To: Yoav Nir Cc: ipsec@ietf.org; Amjad Inamdar (amjads) Subject: Re: [IPsec] Clarification on identities involved in IKEv2EAPauthentication Yoav Nir writes: > Since the gateway acts as a pass-through, the requirement here is more > for the client, which is typically more integrated. The client should > be prepared to give an identity hint both in IKE and later in the EAP > session. And in that case the identities should really be same, and if they differ then the authenticated identity needs to be used for policy lookups, meaning that the EAP identity needs to be used. So the gateway needs to get that authenticated identity from the AAA server so it can do policy lookups based on it. -- kivi...@iki.fi _______________________________________________ IPsec mailing list IPsec@ietf.org https://www.ietf.org/mailman/listinfo/ipsec _______________________________________________ IPsec mailing list IPsec@ietf.org https://www.ietf.org/mailman/listinfo/ipsec
