IETF Logo Mail Archive

Re: [kitten] On SASL's authzid

"Cantor, Scott" <cantor.2@osu.edu> Fri, 07 March 2014 22:19 UTC

Return-Path: <cantor.2@osu.edu>
X-Original-To: kitten@ietfa.amsl.com
Delivered-To: kitten@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B467C1A0128 for <kitten@ietfa.amsl.com>; Fri, 7 Mar 2014 14:19:21 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.2
X-Spam-Level:
X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ldFwecPrgJO7 for <kitten@ietfa.amsl.com>; Fri, 7 Mar 2014 14:19:20 -0800 (PST)
Received: from tx2outboundpool.messaging.microsoft.com (tx2ehsobe004.messaging.microsoft.com [65.55.88.14]) by ietfa.amsl.com (Postfix) with ESMTP id CB6E51A011C for <kitten@ietf.org>; Fri, 7 Mar 2014 14:19:19 -0800 (PST)
Received: from mail56-tx2-R.bigfish.com (10.9.14.244) by TX2EHSOBE007.bigfish.com (10.9.40.27) with Microsoft SMTP Server id 14.1.225.22; Fri, 7 Mar 2014 22:19:15 +0000
Received: from mail56-tx2 (localhost [127.0.0.1]) by mail56-tx2-R.bigfish.com (Postfix) with ESMTP id D728312023A; Fri, 7 Mar 2014 22:19:14 +0000 (UTC)
X-Forefront-Antispam-Report: CIP:164.107.81.208; KIP:(null); UIP:(null); IPV:NLI; H:cio-krc-pf01; RD:none; EFVD:NLI
X-SpamScore: 4
X-BigFish: VPS4(zzbb2dI98dI9371Id799hzz1f42h1d77h208ch1ee6h1de0h1fdah2073h2146h1202h1e76h2189h1d1ah1d2ah21bch1fc6hzz1de098h8275bh1de097hz2fh109h2a8h839h944he5bhf0ah1220h1288h12a5h12a9h12bdh137ah13b6h1441h1504h1537h153bh162dh1631h1758h18e1h1946h19b5h19ceh1ad9h1b0ah224fh1d0ch1d2eh1d3fh1dfeh1dffh1e1dh1fe8h1ff5h2216h22d0h2336h2438h2461h2476h2487h24d7h2516h2545h255eh25cch25f6h2605h1b1cn1b1bi1155h)
Received-SPF: pass (mail56-tx2: domain of osu.edu designates 164.107.81.208 as permitted sender) client-ip=164.107.81.208; envelope-from=cantor.2@osu.edu; helo=cio-krc-pf01 ; cio-krc-pf01 ;
Received: from mail56-tx2 (localhost.localdomain [127.0.0.1]) by mail56-tx2 (MessageSwitch) id 1394230752873184_11326; Fri, 7 Mar 2014 22:19:12 +0000 (UTC)
Received: from TX2EHSMHS011.bigfish.com (unknown [10.9.14.242]) by mail56-tx2.bigfish.com (Postfix) with ESMTP id C6DA520007E; Fri, 7 Mar 2014 22:19:12 +0000 (UTC)
Received: from cio-krc-pf01 (164.107.81.208) by TX2EHSMHS011.bigfish.com (10.9.99.111) with Microsoft SMTP Server (TLS) id 14.16.227.3; Fri, 7 Mar 2014 22:19:12 +0000
Received: from CIO-TNC-HT05.osuad.osu.edu (localhost [127.0.0.1]) (using TLSv1 with cipher RC4-MD5 (128/128 bits)) (No client certificate requested) by cio-krc-pf01 (Postfix) with ESMTPS id 90407A0060; Fri, 7 Mar 2014 17:19:11 -0500 (EST)
Received: from CIO-KRC-D1MBX01.osuad.osu.edu ([fe80::450b:35e6:80f4:f3e0]) by CIO-TNC-HT05.osuad.osu.edu ([fe80::d0be:603:484c:5a2f%10]) with mapi id 14.03.0174.001; Fri, 7 Mar 2014 17:19:11 -0500
From: "Cantor, Scott" <cantor.2@osu.edu>
To: Bill Mills <wmills_92105@yahoo.com>, Nico Williams <nico@cryptonector.com>, "Nordgren, Bryce L -FS" <bnordgren@fs.fed.us>
Thread-Topic: [kitten] On SASL's authzid
Thread-Index: AQHPOanJU7MgJYkHMUqid6fG1ztCiJrVisiAgAB8cgCAACBAgIAAPI8AgAADUQCAAAdPAIAAEpaA//+uhgCAAFWxAP//rbuA
Date: Fri, 07 Mar 2014 22:19:10 +0000
Message-ID: <CF3FAF4D.4B1F4%cantor.2@osu.edu>
References: <CF3FACB9.4B1D8%cantor.2@osu.edu> <1394230416.68245.YahooMailAndroidMobile@web142805.mail.bf1.yahoo.com>
In-Reply-To: <1394230416.68245.YahooMailAndroidMobile@web142805.mail.bf1.yahoo.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [128.146.178.251]
Content-Type: text/plain; charset="us-ascii"
Content-ID: <9156689AC2B7E44C83E16D428A93DFFF@osu.edu>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-CFilter-Loop: Forward
X-OriginatorOrg: osu.edu
X-FOPE-CONNECTOR: Id%0$Dn%*$RO%0$TLS%0$FQDN%$TlsDn%
Archived-At: http://mailarchive.ietf.org/arch/msg/kitten/5Zg_bGvMgMn8KXWfH1K6Z82A_ic
Cc: "kitten@ietf.org" <kitten@ietf.org>
Subject: Re: [kitten] On SASL's authzid
X-BeenThere: kitten@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Common Authentication Technologies - Next Generation <kitten.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/kitten>, <mailto:kitten-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/kitten/>
List-Post: <mailto:kitten@ietf.org>
List-Help: <mailto:kitten-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/kitten>, <mailto:kitten-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 07 Mar 2014 22:19:21 -0000

On 3/7/14, 5:13 PM, "Bill Mills" <wmills_92105@yahoo.com> wrote:

>So can we say that the value in "user" must agree with the user asserted
>by the token?

That depends on what "agree" means. It's a policy issue.

The athzid is the *asserted* identity to login as, which is NOT always
what's in the token. The token is who's logging in, the authzid is who
you're logging in *as* for that transaction.

If by agree you mean "is authorized to act as", then yes. But that's
entirely application layer business, nothing to do with the mechanism.

-- Scott

v2.46.0 | Report a Bug | By Email | System Status