Re: [http-auth] Why is there no SASL support in HTTP?

[Rick van Rein <[e-mail]>]

Hi Tony,

Thanks a lot!

> 1) a mechanism for SASL mechanism discovery.
> 2) the willingness by client and server implementers to extend this into other SASL mechanisms.
>
> #1 could be solved in a straightforward fashion. But I don’t think there’s enough interest currently for #2.

I have a very concrete place where I want it, and it doesn't have the
usual chicken / egg problem:

The Nginx proxy has a "Auth Request" mechanism where authn / authz can
be performed via a HTTP call to a backend; status codes 401, 403 or 2xx
are interpreted and output header values may be harvested.  A similar
mechanism could be used for a SASL backend.

This could directly integrate with its backends for POP3, IMAP, SMTP and
(3rd party) XMPP.  Although there's no direct need to standardise it for
this internal purpose, it may be the best way to go.

That may turn out to be a useful bootstrapping path, making it flow into
closed systems and gradually spreading out.  Wishful thinking?  There's
no way to know but to try...

What you are stating is mostly pragmatic, and the need to build up
enthousiasm for writing it down.  I think HTTP SASL is well worth the
effort, and at least allow HTTP programmers to get away from the in-site
coding of password logic, and adopt more mechanisms.  So I now feel
encouraged to write it down.


Thanks!
 -Rick