Re: [http-auth] UTF-8, usernames, passwords

[Yutaka OIWA <[e-mail]>]

> Actually that is allowed by the current rule in saslprepbis:

>   username   = userpart [1*(1*SP userpart)]


Yes.  I intended that two profile specs are consistent on this.

Sorry for possible confusions, and thank you for clarification.



2014-10-28 10:04 GMT+09:00 Peter Saint-Andre - &yet <[e-mail]>:
> On 10/27/14, 6:52 PM, Yutaka OIWA wrote:
>>
>> Dear all,
>>
>> As an author of another PRECIS draft for HTTP authentication
>> (http://tools.ietf.org/html/draft-oiwa-precis-httpauthprep-00),
>> I personally feel that limiting allowing characters to
>> IdentifierClass is feasible and reasonable.
>> It includes all "sensible IMO" characters for identifiers,
>> is binary compatible with all printable ASCII characters,
>> and is character-set compatible with ISO-8859-1 set.
>> It will not exclude any printable characters which is currently
>> officially allowed in the spec.
>>
>> We should allow any number of "ASCII SPACE" U+0020
>> between printable characters for backward compatibility,
>
>
> Actually that is allowed by the current rule in saslprepbis:
>
>    username   = userpart [1*(1*SP userpart)]
>
>> and should not forbid any printable ASCII characters
>> (except some schema-dependent "forbidden-by-protocol"
>> character like colon <:> in basic).
>> I strongly believe we should forbid any control characters.
>> In both Peter's and my proposals, SPACEs in the
>> beginning and the tail of the string is not allowed,
>> which can be a target to discuss.
>>
>> I'm currently trying to seek for possible merger of
>> my proposal into saslprepbis, to reduce number of
>> profiles to implement.
>
>
> Yes, that is a good goal.
>
>
> Peter
>
> --
> Peter Saint-Andre
> https://andyet.com/