Re: [http-auth] Authentication-Info

[Ken Murchison <[e-mail]>]

On 12/02/2014 07:51 AM, Julian Reschke wrote:
> Hi there,
>
> this is a minor outstanding issue with the Digest and SCRAM drafts. It 
> was discussed in both the WG sessions and in hallway conversations.
>
> This header field originally was defined in the "Digest" part of RFC 
> 2617, and consequently, it was copied over into 
> <http://tools.ietf.org/html/draft-ietf-httpauth-digest-08#section-3.5>.
>
> <http://tools.ietf.org/html/draft-ietf-httpauth-scram-auth-04> 
> currently uses it as well, but with with a slightly differing syntax.
>
> Given the fact that we have two authentication scheme definitions that 
> have a use case for this header field -- shouldn't we define it in a 
> way so that it becomes a generic (optional) feature for 
> authentications schemes?
>
> Choices:
>
> 1) The cleanest approach seems to move the definition into a separate 
> spec which later can be absorbed by a future RFC7235bis. I volunteer 
> to write that spec (it'll be very short), but this would require 
> changes to the Digest spec post-WGLC.

I'm in favor of this approach.



>
> 2) Alternatively, we could tune the Digest draft to introduce the 
> header field in a more generic way, allowing other schemes to use it 
> as well. That would avoid a dependency to a yet unwritten spec, but 
> the complexity wouldn't really change.

This would be my second choice.



>
> 3) We can tell Alexey to pick a different field name, which would 
> shift all required changes to the SCRAM spec.

This is a non-starter as far as I'm concerned.  Two separate response 
header fields to return auth success data seems clumsy.


-- 
Kenneth Murchison
Principal Systems Software Engineer
Carnegie Mellon University