IETF Logo Mail Archive

Re: [apps-discuss] [kitten] [saag] HTTP authentication: the next generation

"Roy T. Fielding" <fielding@gbiv.com> Sun, 12 December 2010 22:37 UTC

Return-Path: <fielding@gbiv.com>
X-Original-To: apps-discuss@core3.amsl.com
Delivered-To: apps-discuss@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id EA2483A6DFA; Sun, 12 Dec 2010 14:37:48 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -102.908
X-Spam-Level:
X-Spam-Status: No, score=-102.908 tagged_above=-999 required=5 tests=[AWL=-0.309, BAYES_00=-2.599, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5F7DPk-i9+xg; Sun, 12 Dec 2010 14:37:48 -0800 (PST)
Received: from homiemail-a73.g.dreamhost.com (caiajhbdcaib.dreamhost.com [208.97.132.81]) by core3.amsl.com (Postfix) with ESMTP id E3FE33A6CCA; Sun, 12 Dec 2010 14:37:47 -0800 (PST)
Received: from homiemail-a73.g.dreamhost.com (localhost [127.0.0.1]) by homiemail-a73.g.dreamhost.com (Postfix) with ESMTP id 765EE1F0069; Sun, 12 Dec 2010 14:39:24 -0800 (PST)
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gbiv.com; h=subject:mime-version :content-type:from:in-reply-to:date:cc:content-transfer-encoding :message-id:references:to; q=dns; s=gbiv.com; b=FYJb5G/ckuimNYH2 EAMF3uuc/bmghPYH8ir/SmwsMldYFoE+q6MzaGFSbJI9RRh/KECrXuBVc6f27dDE yhWSaZliwtQsnTI1hlclvSpj7YkVT+8KdfyzMKny2yqtt3roZAfNF7h3tWfvOKEl SiiYD3rxArbXfIIhT3q52pL2QAA=
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=gbiv.com; h=subject :mime-version:content-type:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; s=gbiv.com; bh=AY54s7iPVjMmfy217h64SJv5wQw=; b=cyn7LDvPTexWvZcI80dZLqHSlJG2 E1gBEKD8jFcSwDbV5YdfvdzZHIXMaoq+R3IN+Ssx1HqjKORiTU7yYahe0XDvqbAM /XzSPPuTPFS5TVncRhVYQ6NaMqT4zN462bWQbXkR52lqQjt4FoIDFAeLLne3QyTS +587nIlVypmcR3A=
Received: from [192.168.1.66] (99-21-208-82.lightspeed.irvnca.sbcglobal.net [99.21.208.82]) (Authenticated sender: fielding@gbiv.com) by homiemail-a73.g.dreamhost.com (Postfix) with ESMTPA id 01E541F0065; Sun, 12 Dec 2010 14:39:23 -0800 (PST)
Mime-Version: 1.0 (Apple Message framework v1082)
Content-Type: text/plain; charset="us-ascii"
From: "Roy T. Fielding" <fielding@gbiv.com>
In-Reply-To: <4D051731.1020400@isode.com>
Date: Sun, 12 Dec 2010 14:39:23 -0800
Content-Transfer-Encoding: quoted-printable
Message-Id: <2230EA03-32C5-4D34-BC6B-304E813BE3A7@gbiv.com>
References: <4D02AF81.6000907@stpeter.im> <p06240809c928635499e8@[10.20.30.150]> <ADDEC353-8DE6-408C-BC75-A50B795E2F6C@checkpoint.com> <78BD0B98-0F20-478B-85F1-DBB45691EB0D@padl.com> <4D0479E3.4050508@gmail.com> <4D04D7D6.4090105@isode.com> <A23730A9-728B-4533-96D7-0B62496CC98A@checkpoint.com> <4D051731.1020400@isode.com>
To: Alexey Melnikov <alexey.melnikov@isode.com>
X-Mailer: Apple Mail (2.1082)
Cc: "apps-discuss@ietf.org" <apps-discuss@ietf.org>, Yoav Nir <ynir@checkpoint.com>, websec <websec@ietf.org>, "kitten@ietf.org" <kitten@ietf.org>, "http-auth@ietf.org" <http-auth@ietf.org>, "saag@ietf.org" <saag@ietf.org>, "ietf-http-wg@w3.org Group" <ietf-http-wg@w3.org>
Subject: Re: [apps-discuss] [kitten] [saag] HTTP authentication: the next generation
X-BeenThere: apps-discuss@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: General discussion of application-layer protocols <apps-discuss.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/apps-discuss>, <mailto:apps-discuss-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/apps-discuss>
List-Post: <mailto:apps-discuss@ietf.org>
List-Help: <mailto:apps-discuss-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/apps-discuss>, <mailto:apps-discuss-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 12 Dec 2010 22:37:49 -0000

On Dec 12, 2010, at 10:40 AM, Alexey Melnikov wrote:

> Yoav Nir wrote:
> 
>> EAP has one advantage. It is easy to integrate with existing RADIUS/DIAMETER infrastructure.
>> 
> True.
> And SASL has an advantage that it is easier to integrate with LDAP infrastructure.
> 
> I think this just demonstrates that before an HTTP authentication mechanism can be evaluated, people need to agree on a common evaluation criteria for HTTP authentication.

Define them all and let's have a bake-off.  It has been 16 years since
HTTP auth was taken out of our hands so that the security experts could
define something perfect.  Zero progress so far.  We should just define
everything and let the security experts do what they do best -- find the
holes and tell us what not to implement.

....Roy

v2.23.0 | Report a Bug | By Email