Re: [http-auth] REST-GSS I-D posted

["KIHARA, Boku" <[e-mail]>]

Dear Nico,

I'm reading the REST-GSS I-D and have several comments on it.

> 2.9.  Server Indication of Authentication Requirement
>
>    When the server wishes to indicate that the client must authenticate
>    in order to access a given resource, then the server MUST respond to
>    the client's HTTP request with either a redirection to a web page
>    with a 303 redirect to a login page (this in the case of browser
>    applications) or a TBD 4xx error indicating that access requires
>    REST-GSS login and, optionally directing the client to the REST-GSS
>    login URI by listing that URI in a response header field named 'REST-
>    GSS-Authenticate'.
>

I'm not sure whether the 'REST-GSS-Authenticate' field is allowed for
only 4xx responses or both 303 and 4xx responses.

> 3.1. Server Decides When to Authenticate
>       C->S: HTTP/1.1 GET /some/resource
>             Host: A.example
>
>       S->C: HTTP/1.1 303 http://A.example/login.html&<encoded-URI>
>
>               Authentication required indication browser apps

Is the URI 'http://A.example/login.html&<encoded-URI>' intended for
the 'Location' field?

What is the clinging '<encoded-URI>'? If it is the REST-GSS login
URI, what is the purpose of this URI here? I think browsers cannot
(or should not) detect the REST-GSS login URI because it is merely a
part of the redirection URI, and servers do not need the '<encoded-URI>'
because they already know the REST-GSS login URI.

>       C->S: HTTP/1.1 GET /some/resource
>             Host: A.example
>
>       S->C: HTTP/1.1 4xx
>             REST-GSS-URI: http://A.example/rest-gss-login
>
>           Authentication required indication for non-browser apps

In this example, the 4xx response has the filed have a field named
'REST-GSS-URI', which is different from 'REST-GSS-Authenticate'
mentioned in 2.9. So which is correct or am I referring different
things?


Sorry for my poor English and small amount of comments, but I hope these help.

Regards,

--
KIHARA, Boku


2011/6/7 Nico Williams <[e-mail]>:
> http://www.ietf.org/id/draft-williams-rest-gss-00.txt
>
> This is to go with the slides and paper presented almost two weeks ago
> at the W3C workshop on identity in the browser:
>
> http://www.w3.org/2011/identity-ws/agenda.html
>
> I would like to add some co-authors.  Anyone interested?
>
> Cheers,
>
> Nico
> --
> _______________________________________________
> http-auth mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/http-auth
>