Index: doc/app_diameap.conf.sample
===================================================================
--- doc/app_diameap.conf.sample	(revision 441)
+++ doc/app_diameap.conf.sample	(revision 565)
@@ -29,4 +29,7 @@
 Load_plugin = "EAP Identity":1:0:"/extensions/eap_identity.emp":"";
 
+# Enable/disable checking User's Identity. If disabled, default parameters value will be used for authentication and authorization attributes.
+# Default values are defined in database for 'Default User'.
+Check_User_Identity = 1;
 
 # In addition to authentication DiamEAP can be configured to check authorization of authenticated users. If set to 0 authorization is disabled, otherwise enabled.( by default disabled).
Index: doc/eap_tls_plugin.diameap.conf.sample
===================================================================
--- doc/eap_tls_plugin.diameap.conf.sample	(revision 425)
+++ doc/eap_tls_plugin.diameap.conf.sample	(revision 565)
@@ -9,2 +9,5 @@
 #CRL file
 #CRL = "<Path to CRL file>";
+
+#Enable/disable checking certificate's CN
+check_cert_cn_username = 1;
Index: extensions/app_diameap/diameap.l
===================================================================
--- extensions/app_diameap/diameap.l	(revision 438)
+++ extensions/app_diameap/diameap.l	(revision 565)
@@ -107,4 +107,7 @@
 			}
 
+(?i:"Check_user_identity")		{
+				return CHECK_USER_IDENTITY;
+			}
 
 "="|";"|":"|","		{	
Index: extensions/app_diameap/diameap.y
===================================================================
--- extensions/app_diameap/diameap.y	(revision 511)
+++ extensions/app_diameap/diameap.y	(revision 565)
@@ -84,4 +84,5 @@
 %token		MAX_INVALID_EAP_PACKET
 %token		MULTI_ROUND_TIMEOUT
+%token		CHECK_USER_IDENTITY
 
 %%	
@@ -93,4 +94,5 @@
 		| confparams MAX_Invalid_EAP_Packet
 		| confparams Multi_Round_Timeout
+		| confparams Check_User_Identity
 		| confparams errors
 		{
@@ -174,6 +176,15 @@
 		config->multi_round_time_out=(unsigned int)$3;
 		};
-				
+
+Check_User_Identity: CHECK_USER_IDENTITY '=' NUM ';'
+		{
+			if((int)$3){
+				check_user_identity = TRUE;
+			}else{
+				check_user_identity = FALSE;
+			}
+		};
 		
+	
 %%
 
Index: extensions/app_diameap/diameap_init.c
===================================================================
--- extensions/app_diameap/diameap_init.c	(revision 465)
+++ extensions/app_diameap/diameap_init.c	(revision 565)
@@ -134,4 +134,6 @@
 	diameap_config->max_invalid_eap_packet = 5;
 	diameap_config->multi_round_time_out = 30;
+	check_user_identity = TRUE;
+
 	return 0;
 }
Index: extensions/app_diameap/diameap_server.c
===================================================================
--- extensions/app_diameap/diameap_server.c	(revision 444)
+++ extensions/app_diameap/diameap_server.c	(revision 565)
@@ -439,4 +439,9 @@
 	}
 
+	if((eap_sm->respMethod == TYPE_IDENTITY) && (length < 6)){
+		TRACE_DEBUG(INFO,"%sUser Identity missing",DIAMEAP_EXTENSION);
+		return 0;
+	}
+
 	eap_sm->rxResp = TRUE;
 	return 0;
Index: extensions/app_diameap/diameap_tls.h
===================================================================
--- extensions/app_diameap/diameap_tls.h	(revision 438)
+++ extensions/app_diameap/diameap_tls.h	(revision 565)
@@ -60,4 +60,7 @@
 	char * crlfile;
 
+	//configuration parameters
+	boolean check_cert_cn_username;
+
 	int max_size;
 
Index: extensions/app_diameap/diameap_user.h
===================================================================
--- extensions/app_diameap/diameap_user.h	(revision 425)
+++ extensions/app_diameap/diameap_user.h	(revision 565)
@@ -74,5 +74,5 @@
 };
 
-
+boolean check_user_identity;
 
 int diameap_user_get_password(struct eap_user user, u8 * password,u16 *length);
Index: extensions/app_diameap/plugins/eap_identity/eap_identity.c
===================================================================
--- extensions/app_diameap/plugins/eap_identity/eap_identity.c	(revision 438)
+++ extensions/app_diameap/plugins/eap_identity/eap_identity.c	(revision 565)
@@ -138,7 +138,13 @@
 	U8COPY((u8 *)user,0,len,Respdata);
 	user[length-5]='\0';
-
-	ret=diameap_get_eap_user(&(smd->user),user);
-
+	if(check_user_identity == FALSE){
+		ret=diameap_get_eap_user(&(smd->user),"Default User");
+		CHECK_MALLOC_DO(smd->user.userid=realloc(smd->user.userid,strlen(user)+1),{ret = 1; goto next;});
+		memcpy(smd->user.userid,user,strlen(user));
+		smd->user.useridLength = strlen(user);
+	} else {
+		ret=diameap_get_eap_user(&(smd->user),user);
+	}
+next:
 	if(ret==0)
 	{
Index: extensions/app_diameap/plugins/eap_tls/eap_tls.c
===================================================================
--- extensions/app_diameap/plugins/eap_tls/eap_tls.c	(revision 425)
+++ extensions/app_diameap/plugins/eap_tls/eap_tls.c	(revision 565)
@@ -70,4 +70,5 @@
 	tls_global_conf.cafile = NULL;
 	tls_global_conf.crlfile = NULL;
+	tls_global_conf.check_cert_cn_username = FALSE;
 
 	/*Parse EAP TLS configuration file */
@@ -185,6 +186,56 @@
 				data->state = SUCCESS;
 				smd->user.success = TRUE;
+
+				if(tls_global_conf.check_cert_cn_username == TRUE){
+					unsigned int list_size;
+					const gnutls_datum_t * list = gnutls_certificate_get_peers (data->session, &list_size);
+					if(list_size<1){
+						goto failure;
+					}
+
+					gnutls_x509_crt_t cert;
+		
+					CHECK_GNUTLS_DO(gnutls_x509_crt_init(&cert),{
+						TRACE_DEBUG(NONE,"%s[EAP TLS plugin] [GnuTLS] error in initialization crt init",DIAMEAP_EXTENSION);
+						goto failure;});
+					
+					CHECK_GNUTLS_DO(gnutls_x509_crt_import(cert, &list[0], GNUTLS_X509_FMT_DER), {
+						TRACE_DEBUG(NONE,"%s[EAP TLS plugin] [GnuTLS] error parsing certificate",DIAMEAP_EXTENSION);
+						goto failure;});
+
+					void * buff;
+					size_t size_buffer;
+					int ret;
+					ret = gnutls_x509_crt_get_dn_by_oid(cert,GNUTLS_OID_X520_COMMON_NAME,0,0,NULL,&size_buffer);
+					if( ret != GNUTLS_E_SHORT_MEMORY_BUFFER){
+						CHECK_GNUTLS_DO(ret,{
+							TRACE_DEBUG(NONE,"%s[EAP TLS plugin] [GnuTLS] error get dn by oid",DIAMEAP_EXTENSION);
+							goto failure;});
+					}
+
+					CHECK_MALLOC_DO(buff=malloc(size_buffer), goto failure);
+
+					CHECK_GNUTLS_DO(gnutls_x509_crt_get_dn_by_oid(cert,GNUTLS_OID_X520_COMMON_NAME,0,0,buff,&size_buffer),{
+						TRACE_DEBUG(NONE,"%s[EAP TLS plugin] [GnuTLS] error get dn by oid",DIAMEAP_EXTENSION);
+						goto failure;});
+
+					if(strcmp((char *)smd->user.userid,buff)!=0){
+						goto failure;
+					}
+
+					gnutls_x509_crt_deinit(cert);				
+					goto next;
+
+					failure:
+					TRACE_DEBUG(NONE,"%s[EAP TLS plugin] Checking failed. certificate's CN does not match User_Name AVP value.",DIAMEAP_EXTENSION);
+					data->state = FAILURE;
+					smd->user.success = FALSE;
+					gnutls_x509_crt_deinit(cert);
+				}
+
+				next:
 				smd->methodData = (struct tls_data*) data;
 				return 0;
+
 			}
 
Index: extensions/app_diameap/plugins/eap_tls/eaptls.l
===================================================================
--- extensions/app_diameap/plugins/eap_tls/eaptls.l	(revision 438)
+++ extensions/app_diameap/plugins/eap_tls/eaptls.l	(revision 565)
@@ -95,4 +95,8 @@
 			}
 
+(?i:"check_cert_cn_username")		{
+				return CHECK_CN_USERNAME;
+			}
+
 
 
Index: extensions/app_diameap/plugins/eap_tls/eaptls.y
===================================================================
--- extensions/app_diameap/plugins/eap_tls/eaptls.y	(revision 438)
+++ extensions/app_diameap/plugins/eap_tls/eaptls.y	(revision 565)
@@ -80,4 +80,5 @@
 %token 		CAPATH
 %token 		CRLPATH
+%token		CHECK_CN_USERNAME
 
 %%	
@@ -87,4 +88,5 @@
 		| confparams CA_file
 		| confparams CRL_file
+		| confparams CHECK_CN_USERNAME_param
 		| confparams errors
 		{
@@ -220,5 +222,17 @@
 		}
 		;
-			
+
+CHECK_CN_USERNAME_param :	
+		CHECK_CN_USERNAME '=' NUM ';'
+		{
+			if((int)$3 == 0){
+				config->check_cert_cn_username = FALSE;
+			}
+			else
+			{
+				config->check_cert_cn_username = TRUE;			
+			}
+		}
+		;
 		
 %%
