[http-auth] Why is there no SASL support in HTTP?

[Rick van Rein <[e-mail]>]

Hello,

I've been wondering why HTTP Authentication does not support SASL, but
instead chooses independent mechanisms from SASL?

Having a pluggable framework that is updated independently from HTTP
appears beneficial to me.  Also, integration with other systems that do
use SASL would be greatly improved.  With support for SASL is so many
mail clients already, its introduction to HTTP clients may be relatively
smooth.

I am aware that mechanisms need to store state on the validating side,
so the server, which contradicts HTTP design.  That may be easily
resolved by passing some state back to the client, and making it supply
when it continues.  For example, digest-based authentication might send
back random bytes as state, and hash it with an internal key to form a
challenge.  When presented with the state and response, the computation
can be validated without a need for state on the server.

Alternatives to state on the server may also exist -- for instance, a
TLS wrapper may provide consistent entropy using RFC 5705.


One thing I've been thinking is that SASL EXTERNAL may be a useful
addition.  Not to actually authenticate, but it could trigger
authorisation processes, possibly using another identity and/or
triggering the generation of Authorization-Info headers that might relay
information (such as identity) to the client at the HTTP layer.


If so desired, I am willing to write an I-D for this.


Thanks,

Rick van Rein
(wishing all a properly secured 2017)
http://internetwide.org