Re: [http-auth] Alexey Melnikov's No Objection on draft-ietf-httpauth-extension-08: (with COMMENT)

[Alexey Melnikov <[e-mail]>]

Hi,

On 3 Sep 2016, at 05:05, 大岩寛 <[e-mail]> wrote:

>> In Section 3, last paragraph:
>> 
>>   Support of this header is OPTIONAL; clients MAY also implement this
>>   extension only for some selected authentication schemes.  New
>>   authentication schemes can make support of the optional
>>   authentication mandatory by its specification, though.
>> 
>> I don't think this paragraph is needed, as this is granted, because support
>> for any extension like specified in this document is optional. So I suggest
>> deleting it.
> 
> Of course, Experimental thing is always optional, as a starting point.
> But if we have two or more OPTIONALs, we need to clarify whether these are
> "one-by-one" or "all-or-nothing".
> What we wanted to assure here is that
> - It's optional support may vary between schemes.
>   For example, an implementation MAY choose to support it in Digest but not in Basic.
>   Also, implementation MAY choose only to support "username" and not "logout-timeout".
>   In this point, it's "one-by-one" OPTIONAL.

In this case I suggest that you either remove the first optional or rephrase this to say that there is no requirement to support this for all supported authentication schemes.
> 
> - We have another "experimental" draft which normatively refers this draft and
>   requires implementation of this extension.
>   It's a kind of "all-or-nothing" (more precisely, "A implies B").
>   It does not contradict with the "experimental status" of this draft.
> 
> These need a little more clarification than just saying "OPTIONAL" or "Experimental".
> If you have some solution to resolve it nicely, it's really appreciated.