<div dir="ltr">Dear Andreas,<div> Thank you for your valuable inputs. My issue is solved now.</div><div><br></div><div>Thanks,</div><div>Ravikanth</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Oct 11, 2016 at 8:47 AM, Andreas Steffen <span dir="ltr"><<a href="mailto:andreas.steffen@strongswan.org" target="_blank">andreas.steffen@strongswan.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">aaa_identity is used by an EAP client to verify the identity<br>
in the TLS server certificate if it is different from the IKEv2<br>
server certificate.<br>
<br>
Regards<br>
<br>
Andreas<br>
<span class=""><br>
On 11.10.2016 13:36, Ravi Kanth Vanapalli wrote:<br>
> Adding option (3) here.<br>
><br>
> 3) auth->add(auth, AUTH_RULE_AAA_IDENTITY, id)<br>
><br>
> Which of the following identities (1),2 or 3 is used to fetch the<br>
> private key in EAP_TLS authentcation.<br>
><br>
><br>
> On Tue, Oct 11, 2016 at 7:28 AM, Ravi Kanth Vanapalli<br>
</span><span class="">> <<a href="mailto:vvnrk.vanapalli@gmail.com">vvnrk.vanapalli@gmail.com</a> <mailto:<a href="mailto:vvnrk.vanapalli@gmail.com">vvnrk.vanapalli@gmail.<wbr>com</a>>> wrote:<br>
><br>
> Sure Andreas. Thank you for this valuable input. I will give a try.<br>
><br>
> Could you please confirm the difference between 1 and 2 below<br>
><br>
> 1) auth->add(auth, AUTH_RULE_IDENTITY, id);<br>
> 2) auth->add(auth, AUTH_RULE_EAP_IDENTITY, id);<br>
><br>
> My understanding is that (1) is used to fill the IDi in the first<br>
> IKE_AUTH message.<br>
> Second one is used for Identitiy verification in EAP methods. eg.<br>
> EAP-TLS uses identity added in AUTH_RULE_EAP_IDENTITY for fetching<br>
> the private certificate.<br>
> (1) and (2) can be different.<br>
><br>
> Kindly confirm that my understanding is correct.<br>
><br>
> Thanks,<br>
> Ravikanth<br>
><br>
> On Tue, Oct 11, 2016 at 3:54 AM, Andreas Steffen<br>
> <<a href="mailto:andreas.steffen@strongswan.org">andreas.steffen@strongswan.<wbr>org</a><br>
</span><div><div class="h5">> <mailto:<a href="mailto:andreas.steffen@strongswan.org">andreas.steffen@<wbr>strongswan.org</a>>> wrote:<br>
><br>
> Hi Ravi,<br>
><br>
> why don't you use the eap_identity parameter?<br>
><br>
> Regards<br>
><br>
> Andreas<br>
><br>
> On 10.10.2016 22:13, Ravi Kanth Vanapalli wrote:<br>
> > Hi all,<br>
> ><br>
> > I have a situation wherein I need to alter the IDi slightly<br>
> before the<br>
> > EAP-TLS authentication proceeds. I.e IDi in the first IKE_AUTH<br>
> message<br>
> > should be different to IDi to be used for user private key<br>
> lookup in the<br>
> > EAP-TLS user authentication.<br>
> ><br>
> > I see that the API 'eap_tls_create_peer' is being used, to<br>
> initialize<br>
> > the peer identitiy in TLSplugin.<br>
> > This is being registered with plugin eap_tls_plugin.c<br>
> ><br>
> > I am finding it difficult to know which module calls this API<br>
> > eap_tls_create_peer to initialize EAP TLS peer identity.<br>
> ><br>
> > Kindly provide any inputs regarding my issue.<br>
> ><br>
> > Thank you very much.<br>
> ><br>
> > --<br>
> > Regards,<br>
> > RaviKanth<br>
><br>
> ==============================<wbr>==============================<wbr>==========<br>
> Andreas Steffen<br>
> <a href="mailto:andreas.steffen@strongswan.org">andreas.steffen@strongswan.org</a><br>
</div></div>> <mailto:<a href="mailto:andreas.steffen@strongswan.org">andreas.steffen@<wbr>strongswan.org</a>><br>
<span class="">> strongSwan - the Open Source VPN Solution!<br>
</span>> <a href="http://www.strongswan.org" rel="noreferrer" target="_blank">www.strongswan.org</a> <<a href="http://www.strongswan.org" rel="noreferrer" target="_blank">http://www.strongswan.org</a>><br>
<span class="">> Institute for Internet Technologies and Applications<br>
> University of Applied Sciences Rapperswil<br>
> CH-8640 Rapperswil (Switzerland)<br>
> ==============================<wbr>=============================[<wbr>ITA-HSR]==<br>
><br>
><br>
><br>
><br>
> --<br>
> Regards,<br>
><br>
> RaviKanth VN Vanapalli<br>
</span>> Email: <a href="mailto:vvnrk.vanapalli@gmail.com">vvnrk.vanapalli@gmail.com</a> <mailto:<a href="mailto:vvnrk.vanapalli@gmail.com">vvnrk.vanapalli@gmail.<wbr>com</a>><br>
<span class="">><br>
><br>
><br>
><br>
> --<br>
> Regards,<br>
><br>
> RaviKanth VN Vanapalli<br>
><br>
<br>
</span>--<br>
<div class="HOEnZb"><div class="h5">==============================<wbr>==============================<wbr>==========<br>
Andreas Steffen <a href="mailto:andreas.steffen@strongswan.org">andreas.steffen@strongswan.org</a><br>
strongSwan - the Open Source VPN Solution! <a href="http://www.strongswan.org" rel="noreferrer" target="_blank">www.strongswan.org</a><br>
Institute for Internet Technologies and Applications<br>
University of Applied Sciences Rapperswil<br>
CH-8640 Rapperswil (Switzerland)<br>
==============================<wbr>=============================[<wbr>ITA-HSR]==<br>
<br>
</div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><font color="#666666">Regards,</font></div>
<div><br><font color="#666666">RaviKanth VN Vanapalli</font></div><div><font color="#666666">Ph: (469) 999 7567</font></div>
<div><font color="#666666">Email: </font><a href="mailto:vvnrk.vanapalli@gmail.com" target="_blank"><font color="#666666">vvnrk.vanapalli@gmail.com</font></a></div></div></div>
</div>