Re: [http-auth] Authentication-Info

Hi Julian,

The Digest draft based the definition of the Authentication-Info header on
the auth-param defined in RFC7235, and it registers the header with the
Message Header Field Registry.

What else do you think we need to do to make it generic?

Regards,
 Rifaat

On Tue, Dec 2, 2014 at 7:51 AM, Julian Reschke <julian.reschke@gmx.de>
wrote:

> Hi there,
>
> this is a minor outstanding issue with the Digest and SCRAM drafts. It was
> discussed in both the WG sessions and in hallway conversations.
>
> This header field originally was defined in the "Digest" part of RFC 2617,
> and consequently, it was copied over into <http://tools.ietf.org/html/
> draft-ietf-httpauth-digest-08#section-3.5>.
>
> <http://tools.ietf.org/html/draft-ietf-httpauth-scram-auth-04> currently
> uses it as well, but with with a slightly differing syntax.
>
> Given the fact that we have two authentication scheme definitions that
> have a use case for this header field -- shouldn't we define it in a way so
> that it becomes a generic (optional) feature for authentications schemes?
>
> Choices:
>
> 1) The cleanest approach seems to move the definition into a separate spec
> which later can be absorbed by a future RFC7235bis. I volunteer to write
> that spec (it'll be very short), but this would require changes to the
> Digest spec post-WGLC.
>
> 2) Alternatively, we could tune the Digest draft to introduce the header
> field in a more generic way, allowing other schemes to use it as well. That
> would avoid a dependency to a yet unwritten spec, but the complexity
> wouldn't really change.
>
> 3) We can tell Alexey to pick a different field name, which would shift
> all required changes to the SCRAM spec.
>
> Feedback appreciated,
>
> Julian
>
> _______________________________________________
> http-auth mailing list
> http-auth@ietf.org
> https://www.ietf.org/mailman/listinfo/http-auth
>