TLS: assigning certificates to username
a.cudbardb at freeradius.org
Fri May 6 05:08:18 CEST 2016
> On 5 May 2016, at 16:25, Arran Cudbard-Bell <a.cudbardb at freeradius.org> wrote:
>> On 5 May 2016, at 16:09, Arran Cudbard-Bell <a.cudbardb at freeradius.org> wrote:
>>> On 5 May 2016, at 15:11, A.L.M.Buxey at lboro.ac.uk wrote:
>>>> So in fact I revise my previous statement, if your cert contains an NAI in the CN part of the subject, your system administrator is an idiot.
>>> but if we are being pragmatic.. subjectAltName used for proxying decisions in EAP-TLS?
>>> the commonname is used
>> I'm not sure what your point is. Certificates aren't used in proxying decisions. They can't be. It's too late by the time you've received the certificate from the supplicant.
> My main reason for being less than enthusiastic about using CN for NAIs, is because in LDAP (also X509)
Maybe idiot was too harsh. Just saying it's probably not a good thing to do :)
Arran Cudbard-Bell <a.cudbardb at freeradius.org>
FreeRADIUS Development Team
FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 872 bytes
Desc: Message signed with OpenPGP using GPGMail
More information about the Freeradius-Users