[strongSwan] initialzing EAP TLS peer with a different IDi than the IDi used in teh first IKE AUTH message
andreas.steffen at strongswan.org
Tue Oct 11 14:47:07 CEST 2016
aaa_identity is used by an EAP client to verify the identity
in the TLS server certificate if it is different from the IKEv2
On 11.10.2016 13:36, Ravi Kanth Vanapalli wrote:
> Adding option (3) here.
> 3) auth->add(auth, AUTH_RULE_AAA_IDENTITY, id)
> Which of the following identities (1),2 or 3 is used to fetch the
> private key in EAP_TLS authentcation.
> On Tue, Oct 11, 2016 at 7:28 AM, Ravi Kanth Vanapalli
> <vvnrk.vanapalli at gmail.com <mailto:vvnrk.vanapalli at gmail.com>> wrote:
> Sure Andreas. Thank you for this valuable input. I will give a try.
> Could you please confirm the difference between 1 and 2 below
> 1) auth->add(auth, AUTH_RULE_IDENTITY, id);
> 2) auth->add(auth, AUTH_RULE_EAP_IDENTITY, id);
> My understanding is that (1) is used to fill the IDi in the first
> IKE_AUTH message.
> Second one is used for Identitiy verification in EAP methods. eg.
> EAP-TLS uses identity added in AUTH_RULE_EAP_IDENTITY for fetching
> the private certificate.
> (1) and (2) can be different.
> Kindly confirm that my understanding is correct.
> On Tue, Oct 11, 2016 at 3:54 AM, Andreas Steffen
> <andreas.steffen at strongswan.org
> <mailto:andreas.steffen at strongswan.org>> wrote:
> Hi Ravi,
> why don't you use the eap_identity parameter?
> On 10.10.2016 22:13, Ravi Kanth Vanapalli wrote:
> > Hi all,
> > I have a situation wherein I need to alter the IDi slightly
> before the
> > EAP-TLS authentication proceeds. I.e IDi in the first IKE_AUTH
> > should be different to IDi to be used for user private key
> lookup in the
> > EAP-TLS user authentication.
> > I see that the API 'eap_tls_create_peer' is being used, to
> > the peer identitiy in TLSplugin.
> > This is being registered with plugin eap_tls_plugin.c
> > I am finding it difficult to know which module calls this API
> > eap_tls_create_peer to initialize EAP TLS peer identity.
> > Kindly provide any inputs regarding my issue.
> > Thank you very much.
> > --
> > Regards,
> > RaviKanth
> Andreas Steffen
> andreas.steffen at strongswan.org
> <mailto:andreas.steffen at strongswan.org>
> strongSwan - the Open Source VPN Solution!
> www.strongswan.org <http://www.strongswan.org>
> Institute for Internet Technologies and Applications
> University of Applied Sciences Rapperswil
> CH-8640 Rapperswil (Switzerland)
> RaviKanth VN Vanapalli
> Email: vvnrk.vanapalli at gmail.com <mailto:vvnrk.vanapalli at gmail.com>
> RaviKanth VN Vanapalli
Andreas Steffen andreas.steffen at strongswan.org
strongSwan - the Open Source VPN Solution! www.strongswan.org
Institute for Internet Technologies and Applications
University of Applied Sciences Rapperswil
CH-8640 Rapperswil (Switzerland)
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 3859 bytes
Desc: S/MIME Cryptographic Signature
More information about the Users