Re: [http-auth] Quick review of draft-ietf-httpauth-rest-auth-01

[Julian Reschke <[e-mail]>]

On 2013-11-06 08:29, Ilari Liusvaara wrote:
>> 1.  Introduction
>>
>>     We propose a pattern for HTTP [RFC2616] [TODO: add reference to
>>     HTTP/2.0 as well?] authentication mechanisms that, by being
>>     "RESTful", obtains these goals naturally.
>
> Reference for HTTP/2.0 would be draft-ietf-httpbis-http2

Please stop referencing RFC 2616. HTTPbis is past IETF LC.

>> 3.1.  Negotiable Parameters
>>
>> 3.1.2.  WWW-Authenticate Header Value Prefix Syntax
>>
>>     For a DIGEST-like mechanism it might look like "WWW-Authenticate: RA-
>>     Digest-SHA-256 tls-server-end-point session-ID no HE4SgWGrd/
>>     3+O7t16HqusA==".  For example, the mechname for the Kerberos V5 GSS-
>>     API mechanism might be "gss-krb5", and a WWW-Authenticate header
>>     value for it might look like "WWW-Authenticate: RA-gss-krb5
>>     http://foo.example/restauth-login tls-server-end-point channel-bound-
>>     session-ID r=no".
>
> These examples don't look to conform to the grammar given (missing r=, s=,
> etc...)
> ...

Furthermore, the challenge does not conform to the grammar defined in 
<http://greenbytes.de/tech/webdav/draft-ietf-httpbis-p7-auth-24.html#challenge.and.response> 
(nor 
<http://greenbytes.de/tech/webdav/rfc2617.html#access.authentication.framework>).

Best regards, Julian