Re: [kitten] Pending draft 15 Re: sasl-oauth "user" as a kvpair or in the gs2 header?

[Nico Williams <[e-mail]>]

On Fri, Mar 14, 2014 at 4:52 PM, Bill Mills <[e-mail]> wrote:
> Quoting here, in the hope that it piques someone's interest.  New proposed
> language is:
>
> " Client responses are a GS2 [RFC5801] header followed by a key/value pair
> sequence, or may be empty. The gs2-header is defined here for compatibility
> with GS2 if a GS2 mechanism is formally defined, but this document does not

s/formally/eventually/ ?

> define one. These key/value pairs carry the equivalent values from an HTTP
> context in order to be able to complete an OAuth style HTTP authorization.
> Unknown key/value pairs MUST be ignored by the server. The ABNF [RFC5234]
> syntax is:
>
>
>   kvsep          = %x01
>   key            = 1*(ALPHA / ",")
>   value          = *(VCHAR / SP / HTAB / CR / LF )
>   kvpair         = key "=" value kvsep
> ;;gs2-header     = See RFC 5801
>   client_resp    = (gs2-header kvsep 0*kvpair kvsep) / kvsep
>
> The GS2 header MUST inclde the user name asociated with the resource being
> accessed, the "authzid"."

Hmm, MUST?  SASL allows the app to not use an authzid if it doesn't
want to.  I understand that Google's OAuth use case requires an
authzid, but it's not obvious to me that all OAuth use cases will.

+ the two typos Ryan noticed.

Nico
--