Re: [http-auth] RFC 7804 One Round-Trip Reauthentication
Alexey Melnikov <alexey.melnikov@isode.com> Wed, 30 November 2016 12:42 UTC
Return-Path: <alexey.melnikov@isode.com>
X-Original-To: http-auth@ietfa.amsl.com
Delivered-To: http-auth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8132C1297BC for <http-auth@ietfa.amsl.com>; Wed, 30 Nov 2016 04:42:49 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.097
X-Spam-Level:
X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_05=-0.5, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RP_MATCHES_RCVD=-1.497, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=isode.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DtacRUmpuO3w for <http-auth@ietfa.amsl.com>; Wed, 30 Nov 2016 04:42:48 -0800 (PST)
Received: from waldorf.isode.com (waldorf.isode.com [62.232.206.188]) by ietfa.amsl.com (Postfix) with ESMTP id F15911297A7 for <http-auth@ietf.org>; Wed, 30 Nov 2016 04:42:47 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; t=1480509767; d=isode.com; s=june2016; i=@isode.com; bh=HkkEbO83UFpvRaXDAu7h0JQkVHmOZ+vZY6FyWv7qDsU=; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version: In-Reply-To:References:Content-Type:Content-Transfer-Encoding: Content-ID:Content-Description; b=YJ9Q9d66bGvIYTVbhikuiCrPmOHQGzoaz7mKUPA7zEcE2649B60U0+W+Bzc3y4Vrj/L3YF png3mi0H+IYBH1606JcFS8U+F3UA3eSma/1uvJDih/ANRvBoNpyXcUB6LIfkEP3uDyYL2n 1Tz/GfKKG1iJLKqlQc4zyx5EUH/2SRw=;
Received: from [172.20.1.215] (dhcp-215.isode.net [172.20.1.215]) by waldorf.isode.com (submission channel) via TCP with ESMTPSA id <WD7JRgAZuo8f@waldorf.isode.com>; Wed, 30 Nov 2016 12:42:46 +0000
To: Isen Ng <isen@treeboxsolutions.com>, http-auth@ietf.org
References: <CABR9bnzG9Zv+YYN5psnLZzyHUBzg14WVH8VuJkG_w4YZb4PRhg@mail.gmail.com>
From: Alexey Melnikov <alexey.melnikov@isode.com>
Message-ID: <81f2ff57-64a1-47cb-49bd-dfa17aaacdc8@isode.com>
Date: Wed, 30 Nov 2016 12:42:34 +0000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0
In-Reply-To: <CABR9bnzG9Zv+YYN5psnLZzyHUBzg14WVH8VuJkG_w4YZb4PRhg@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="------------AC3D885BB088D20FAD70B337"
Archived-At: <https://mailarchive.ietf.org/arch/msg/http-auth/C2Art2lRgQ2GyzUqEGijhoBTVmM>
Subject: Re: [http-auth] RFC 7804 One Round-Trip Reauthentication
X-BeenThere: http-auth@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: HTTP authentication methods <http-auth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/http-auth>, <mailto:http-auth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/http-auth/>
List-Post: <mailto:http-auth@ietf.org>
List-Help: <mailto:http-auth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/http-auth>, <mailto:http-auth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 30 Nov 2016 12:42:49 -0000
Hi Isen, On 28/11/2016 06:11, Isen Ng wrote: > Hi, > > I'm looking at RFC 7804, specifically at "One Round-Trip > Reauthentication" (https://tools.ietf.org/html/rfc7804#page-10). > > It is said that > "If the client has authenticated to the same realm before (i.e., it > remembers "i" and "s" attributes for the user from earlier > authentication exchanges with the server), it can respond to that > with "client-final-message"" > And the example give: > C: GET /resource HTTP/1.1 > C: Host:server.example.com <http://server.example.com> > C: Authorization: SCRAM-SHA-256 realm="testrealm@example.com <mailto:testrealm@example.com>", > data=Yz1iaXdzLHI9ck9wck5HZndFYmVSV2diTkVrcU80MDk2JWh2WURwV1VhM > lJhVENBZnV4RklsailoTmxGLHA9ZEh6YlphcFdJazRqVWhOK1V0ZTl5dGFnOX > pqZk1IZ3NxbW1pejdBbmRWUT0K > > C: [...] > In this case, there no longer is an attribute named "sid" in this > "client-final-message". > How does the server know which user's secret to use to calculate the > proof for matching? You are right, I messed it up! The client should be sending "n=<username>" somewhere in this response. Are you trying to implement this? Best Regards, Alexey