Re: [http-auth] Barry Leiba's Discuss on draft-ietf-httpauth-hoba-09: (with DISCUSS and COMMENT)

[Michael Thomas <[e-mail]>]

Thanks, Barry. The programmer in me thinks these are very useful too.

Mike

On 01/06/2015 06:05 AM, Barry Leiba wrote:
>>> This document would benefit from some section somewhere giving a set
>>> of clear, numbered steps, saying who sends, who receives, and who does
>>> what with what input at each step.  I will propose such text.
>> And I'll happily look at that when it's available. (And hope to not have
>> to wait much:-)
>
> 1.
>     And here we go; not a lot, but I think it really helps.  Of course, adjust it if I got anything wrong or worded inaccurately.  Note how the section references jump around -- that's why I found it hard to follow, and why I think this is a big help.  I'm suggesting making this Section 1.3 because I think having it up front makes it the most useful.
>
>     -------------------------------------
>     1.3 An Overview of HOBA-http Authentication
>
>     HOBA authentication uses the HTTP authentication framework defined in
>     [RFC7235], using a number of HOBA-specific elements.  This is a high-level
>     overview of HOBA-http authentication:
>
>     1. If the user is not already registered with the web-origin and realm it is
>     trying to access, the "joining" process is invoked (see Section 6.1).  This
>     creates a key pair and makes the CPK known to the server.
>
>     2. The client connects to the server and makes a request, and the server's
>     response includes a WWW-Authenticate header field that contains the "HOBA"
>     auth-scheme, along with associated parameters (see Section 3).
>
>     3. The client uses the challenge from the HOBA auth-scheme parameters, along
>     with other information it knows about the web-origin and realm, to create
>     and sign a HOBA-TBS string (see Section 2).
>
>     4. The client creates a HOBA client-result (HOBA-RES), using the signed
>     HOBA-TBS for the "sig" value (see Section 2).
>
>     5. The client includes the Authorization header field in its next request,
>     using the "HOBA" auth-scheme and putting the HOBA client-result in an
>     auth-param named "result" (see Section 3).
>
>     6. The server authenticates the HOBA client-result (see Section 5.3).
>
>     7. Typically, the server's response includes a session cookie that allows
>     the client to indicate its authentication state in future requests (see
>     Section 1.1).
>
>     [You might include an example here, as Julian suggests.  Or perhaps you might put an example in an appendix, and just cite it here.]
>
>     -------------------------------------
>
>     Please let me know what you think.
>
>     Barry
>