notes on case sensitivity

diff --git a/raddb/policy.d/filter b/raddb/policy.d/filter
index 0121f29b8f83a033fdcd2dd2c787c9457383bf17..b35bd59cc1ec73815165e4082c76afe79c302c3f 100644 (file)
--- a/raddb/policy.d/filter
+++ b/raddb/policy.d/filter
@@ -169,6 +169,13 @@ filter_inner_identity {
                #  the outer one is "example.com" and the inner
                #  is "secure.example.com"
                #
+               #  Note that we do EQUALITY checks for realm names.
+               #  There is no simple way to do case insensitive checks
+               #  on internationalized domain names.  On top of that,
+               #  allowing outer "anonymous@EXAMPLE.COM" and inner
+               #  "user@example.com" is just stupid.  The user should
+               #  enter the same realm for both inner and outer identities.
+               #
                if (&Inner-Realm-Name && &Outer-Realm-Name && \
                    (&Inner-Realm-Name != &Outer-Realm-Name) && \
                    (&Inner-Realm-Name !~ /\.%{Outer-Realm-Name}$/)) {