<div dir="ltr">From the code it looks like, identity set using <span style="font-size:12.8px">AUTH_RULE_EAP_IDENTITY is used only in the EAP Identity rounds . </span><div><span style="font-size:12.8px">This identity is not being used for id check in API find_private_key in tls_peer.c</span></div><div><br></div><div>Thanks,</div><div>Ravikanth</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Oct 11, 2016 at 12:09 PM, Ravi Kanth Vanapalli <span dir="ltr"><<a href="mailto:vvnrk.vanapalli@gmail.com" target="_blank">vvnrk.vanapalli@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Dear Andreas,<div> Looks my issue is not solved yet.</div><div> I have modified the identity with the statement below</div><div><span style="font-size:12.8px">(1) auth->add(auth, AUTH_RULE_EAP_IDENTITY, id2);</span><br></div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px">But still EAP-TLS is looking for Idenity set with</span></div><div><span style="font-size:12.8px"><br></span></div><div><span class="m_8779719908413061017gmail-m_2000478233086352340gmail-Apple-tab-span" style="font-size:12.8px;white-space:pre-wrap">1) </span><span style="font-size:12.8px">auth->add(auth, AUTH_RULE_IDENTITY, id1);</span><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px">Can you please help me with this issue.</span></div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px">Thanks,</span></div><div><span style="font-size:12.8px">Ravikanth</span></div></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Oct 11, 2016 at 12:02 PM, Ravi Kanth Vanapalli <span dir="ltr"><<a href="mailto:vvnrk.vanapalli@gmail.com" target="_blank">vvnrk.vanapalli@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Dear Andreas,<div> Thank you for your valuable inputs. My issue is solved now.</div><div><br></div><div>Thanks,</div><div>Ravikanth</div></div><div class="gmail_extra"><div><div class="m_8779719908413061017h5"><br><div class="gmail_quote">On Tue, Oct 11, 2016 at 8:47 AM, Andreas Steffen <span dir="ltr"><<a href="mailto:andreas.steffen@strongswan.org" target="_blank">andreas.steffen@strongswan.or<wbr>g</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">aaa_identity is used by an EAP client to verify the identity<br>
in the TLS server certificate if it is different from the IKEv2<br>
server certificate.<br>
<br>
Regards<br>
<br>
Andreas<br>
<span><br>
On 11.10.2016 13:36, Ravi Kanth Vanapalli wrote:<br>
> Adding option (3) here.<br>
><br>
> 3) auth->add(auth, AUTH_RULE_AAA_IDENTITY, id)<br>
><br>
> Which of the following identities (1),2 or 3 is used to fetch the<br>
> private key in EAP_TLS authentcation.<br>
><br>
><br>
> On Tue, Oct 11, 2016 at 7:28 AM, Ravi Kanth Vanapalli<br>
</span><span>> <<a href="mailto:vvnrk.vanapalli@gmail.com" target="_blank">vvnrk.vanapalli@gmail.com</a> <mailto:<a href="mailto:vvnrk.vanapalli@gmail.com" target="_blank">vvnrk.vanapalli@gmail.<wbr>com</a>>> wrote:<br>
><br>
> Sure Andreas. Thank you for this valuable input. I will give a try.<br>
><br>
> Could you please confirm the difference between 1 and 2 below<br>
><br>
> 1) auth->add(auth, AUTH_RULE_IDENTITY, id);<br>
> 2) auth->add(auth, AUTH_RULE_EAP_IDENTITY, id);<br>
><br>
> My understanding is that (1) is used to fill the IDi in the first<br>
> IKE_AUTH message.<br>
> Second one is used for Identitiy verification in EAP methods. eg.<br>
> EAP-TLS uses identity added in AUTH_RULE_EAP_IDENTITY for fetching<br>
> the private certificate.<br>
> (1) and (2) can be different.<br>
><br>
> Kindly confirm that my understanding is correct.<br>
><br>
> Thanks,<br>
> Ravikanth<br>
><br>
> On Tue, Oct 11, 2016 at 3:54 AM, Andreas Steffen<br>
> <<a href="mailto:andreas.steffen@strongswan.org" target="_blank">andreas.steffen@strongswan.o<wbr>rg</a><br>
</span><div><div class="m_8779719908413061017m_-9011560731488112397h5">> <mailto:<a href="mailto:andreas.steffen@strongswan.org" target="_blank">andreas.steffen@stron<wbr>gswan.org</a>>> wrote:<br>
><br>
> Hi Ravi,<br>
><br>
> why don't you use the eap_identity parameter?<br>
><br>
> Regards<br>
><br>
> Andreas<br>
><br>
> On 10.10.2016 22:13, Ravi Kanth Vanapalli wrote:<br>
> > Hi all,<br>
> ><br>
> > I have a situation wherein I need to alter the IDi slightly<br>
> before the<br>
> > EAP-TLS authentication proceeds. I.e IDi in the first IKE_AUTH<br>
> message<br>
> > should be different to IDi to be used for user private key<br>
> lookup in the<br>
> > EAP-TLS user authentication.<br>
> ><br>
> > I see that the API 'eap_tls_create_peer' is being used, to<br>
> initialize<br>
> > the peer identitiy in TLSplugin.<br>
> > This is being registered with plugin eap_tls_plugin.c<br>
> ><br>
> > I am finding it difficult to know which module calls this API<br>
> > eap_tls_create_peer to initialize EAP TLS peer identity.<br>
> ><br>
> > Kindly provide any inputs regarding my issue.<br>
> ><br>
> > Thank you very much.<br>
> ><br>
> > --<br>
> > Regards,<br>
> > RaviKanth<br>
><br>
> =============================<wbr>==============================<wbr>===========<br>
> Andreas Steffen<br>
> <a href="mailto:andreas.steffen@strongswan.org" target="_blank">andreas.steffen@strongswan.org</a><br>
</div></div>> <mailto:<a href="mailto:andreas.steffen@strongswan.org" target="_blank">andreas.steffen@stron<wbr>gswan.org</a>><br>
<span>> strongSwan - the Open Source VPN Solution!<br>
</span>> <a href="http://www.strongswan.org" rel="noreferrer" target="_blank">www.strongswan.org</a> <<a href="http://www.strongswan.org" rel="noreferrer" target="_blank">http://www.strongswan.org</a>><br>
<span>> Institute for Internet Technologies and Applications<br>
> University of Applied Sciences Rapperswil<br>
> CH-8640 Rapperswil (Switzerland)<br>
> =============================<wbr>==============================<wbr>[ITA-HSR]==<br>
><br>
><br>
><br>
><br>
> --<br>
> Regards,<br>
><br>
> RaviKanth VN Vanapalli<br>
</span>> Email: <a href="mailto:vvnrk.vanapalli@gmail.com" target="_blank">vvnrk.vanapalli@gmail.com</a> <mailto:<a href="mailto:vvnrk.vanapalli@gmail.com" target="_blank">vvnrk.vanapalli@gmail.<wbr>com</a>><br>
<span>><br>
><br>
><br>
><br>
> --<br>
> Regards,<br>
><br>
> RaviKanth VN Vanapalli<br>
><br>
<br>
</span>--<br>
<div class="m_8779719908413061017m_-9011560731488112397HOEnZb"><div class="m_8779719908413061017m_-9011560731488112397h5">==============================<wbr>==============================<wbr>==========<br>
Andreas Steffen <a href="mailto:andreas.steffen@strongswan.org" target="_blank">andreas.steffen@strongswan.or<wbr>g</a><br>
strongSwan - the Open Source VPN Solution! <a href="http://www.strongswan.org" rel="noreferrer" target="_blank">www.strongswan.org</a><br>
Institute for Internet Technologies and Applications<br>
University of Applied Sciences Rapperswil<br>
CH-8640 Rapperswil (Switzerland)<br>
==============================<wbr>=============================[<wbr>ITA-HSR]==<br>
<br>
</div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br></div></div><div class="m_8779719908413061017m_-9011560731488112397gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><font color="#666666">Regards,</font></div>
<div><br><font color="#666666">RaviKanth VN Vanapalli</font></div><span><div><font color="#666666">Ph: <a href="tel:%28469%29%20999%207567" value="+14699997567" target="_blank">(469) 999 7567</a></font></div>
<div><font color="#666666">Email: </font><a href="mailto:vvnrk.vanapalli@gmail.com" target="_blank"><font color="#666666">vvnrk.vanapalli@gmail.com</font></a></div></span></div></div>
</div>
</blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="m_8779719908413061017gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><font color="#666666">Regards,</font></div>
<div><br><font color="#666666">RaviKanth VN Vanapalli</font></div><div><font color="#666666">Ph: <a href="tel:%28469%29%20999%207567" value="+14699997567" target="_blank">(469) 999 7567</a></font></div>
<div><font color="#666666">Email: </font><a href="mailto:vvnrk.vanapalli@gmail.com" target="_blank"><font color="#666666">vvnrk.vanapalli@gmail.com</font></a></div></div></div>
</div>
</div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><font color="#666666">Regards,</font></div>
<div><br><font color="#666666">RaviKanth VN Vanapalli</font></div><div><font color="#666666">Ph: (469) 999 7567</font></div>
<div><font color="#666666">Email: </font><a href="mailto:vvnrk.vanapalli@gmail.com" target="_blank"><font color="#666666">vvnrk.vanapalli@gmail.com</font></a></div></div></div>
</div>