[http-auth] Authentication-Info

[Julian Reschke <[e-mail]>]

Hi there,

this is a minor outstanding issue with the Digest and SCRAM drafts. It 
was discussed in both the WG sessions and in hallway conversations.

This header field originally was defined in the "Digest" part of RFC 
2617, and consequently, it was copied over into 
<http://tools.ietf.org/html/draft-ietf-httpauth-digest-08#section-3.5>.

<http://tools.ietf.org/html/draft-ietf-httpauth-scram-auth-04> currently 
uses it as well, but with with a slightly differing syntax.

Given the fact that we have two authentication scheme definitions that 
have a use case for this header field -- shouldn't we define it in a way 
so that it becomes a generic (optional) feature for authentications schemes?

Choices:

1) The cleanest approach seems to move the definition into a separate 
spec which later can be absorbed by a future RFC7235bis. I volunteer to 
write that spec (it'll be very short), but this would require changes to 
the Digest spec post-WGLC.

2) Alternatively, we could tune the Digest draft to introduce the header 
field in a more generic way, allowing other schemes to use it as well. 
That would avoid a dependency to a yet unwritten spec, but the 
complexity wouldn't really change.

3) We can tell Alexey to pick a different field name, which would shift 
all required changes to the SCRAM spec.

Feedback appreciated,

Julian