The Network Access Identifier
obsoleted by
- rfc-4282 — The Network Access Identifier
Extracted elements (14)
The NAI is intended to be used by the NAS both for identifying the user's home authentication server and as part of the process of opening a new tunnel to determine the tunnel endpoint, supporting VPN use cases via PPTP, L2F, L2TP, and IPsec.
The realm portion of the NAI grammar permits realms beginning with a digit (e.g., 3com.com), unlike the BNF in RFC 1035 (DNS). This change was made to reflect current practice, as such FQDNs are commonly used and accepted by current software.
Using an FQDN as the realm name does not imply use of the DNS for location of the authentication server or for authentication routing. Existing roaming implementations handle authentication server location via local proxy configuration files, not DNS, though DNS SRV records (RFC 2052) could be used.
Invalid NAI examples include: a realm without a dot (fred@foo), realm labels with underscores (fred@foo_9.com), empty username (@howard.edu), multiple at-signs ([email protected]@smallco.com), and colons or semicolons in the username.
The NAI may not necessarily be the same as the user's e-mail address or the userID submitted in an application-layer authentication. Implementations must not assume these identifiers are equivalent.
There is no requirement that the NAI represent a valid email address; the NAI realm is an administrative namespace for roaming that happens to use FQDN syntax but is semantically distinct from an SMTP address.
Devices handling NAIs MUST support an NAI length of at least 72 octets. NAS vendors may need to modify their devices to comply.
NAI realm names are required to be unique, and the rights to use a given NAI realm for roaming purposes are obtained coincident with acquiring rights to use the corresponding fully qualified domain name (FQDN).
The Network Access Identifier (NAI) is the userID submitted by the client during PPP authentication, taking the form 'user@realm'. Its purpose is to identify the user and assist in routing the authentication request to the home server.
The realm portion is defined as a dot-separated sequence of labels, where each label begins with a letter or digit (let-dig) and may contain hyphens. Underscores are not permitted in realm labels.
The username portion of the NAI conforms to the dot-string BNF from RFC 821 (SMTP). Characters allowed include printable ASCII excluding specials (angle brackets, parentheses, brackets, backslash, dot, comma, semicolon, colon, at-sign, double-quote) and control characters.
This document defines the NAI realm namespace and specifies that its administration piggybacks on DNS namespace administration. Rights to use an NAI realm are obtained coincident with acquiring rights to use the corresponding FQDN; using a realm without owning the FQDN is discouraged.
An NAI reveals the home affiliation of a user, which may assist an attacker in probing the username space. This is most concerning in protocols that transmit the username in clear-text, such as RADIUS. IPsec confidentiality services (RFC 2401) may be used to prevent snooping.
The NAI ABNF grammar defines: nai = username / (username "@" realm), where username is a dot-string derived from RFC 821, and realm is a dot-separated sequence of DNS labels (let-dig followed by optional ldh-str). Special characters and control characters are excluded from the username char production.