From: Alan T. DeKok <aland@freeradius.org>
Date: Thu, 31 Dec 2015 00:53:17 +0000 (-0500)
Subject: notes on case sensitivity
X-Git-Tag: release_3_0_11~44
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=25b992c0c39308d77a6fd15f6be6a4e866189ab7;p=thirdparty%2Ffreeradius-server.git

notes on case sensitivity
---

diff --git a/raddb/policy.d/filter b/raddb/policy.d/filter
index 0121f29b8f8..b35bd59cc1e 100644
--- a/raddb/policy.d/filter
+++ b/raddb/policy.d/filter
@@ -169,6 +169,13 @@ filter_inner_identity {
 		#  the outer one is "example.com" and the inner
 		#  is "secure.example.com"
 		#
+		#  Note that we do EQUALITY checks for realm names.
+		#  There is no simple way to do case insensitive checks
+		#  on internationalized domain names.  On top of that,
+		#  allowing outer "anonymous@EXAMPLE.COM" and inner
+		#  "user@example.com" is just stupid.  The user should
+		#  enter the same realm for both inner and outer identities.
+		#
 		if (&Inner-Realm-Name && &Outer-Realm-Name && \
 		    (&Inner-Realm-Name != &Outer-Realm-Name) && \
 		    (&Inner-Realm-Name !~ /\.%{Outer-Realm-Name}$/)) {