IETF Logo Mail Archive

Re: [kitten] On SASL's authzid

Bill Mills <wmills@yahoo-inc.com> Mon, 10 March 2014 18:26 UTC

Return-Path: <wmills@yahoo-inc.com>
X-Original-To: kitten@ietfa.amsl.com
Delivered-To: kitten@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 51AE31A03FC for <kitten@ietfa.amsl.com>; Mon, 10 Mar 2014 11:26:35 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -16.92
X-Spam-Level:
X-Spam-Status: No, score=-16.92 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_NEUTRAL=0.779, USER_IN_DEF_WHITELIST=-15] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wqCc61qhHmqs for <kitten@ietfa.amsl.com>; Mon, 10 Mar 2014 11:26:34 -0700 (PDT)
Received: from mrout1.yahoo.com (mrout1.yahoo.com [216.145.54.171]) by ietfa.amsl.com (Postfix) with ESMTP id 116591A048A for <kitten@ietf.org>; Mon, 10 Mar 2014 11:26:34 -0700 (PDT)
Received: from GQ1-EX10-CAHT09.y.corp.yahoo.com (gq1-ex10-caht09.corp.gq1.yahoo.com [10.87.93.108]) by mrout1.yahoo.com (8.14.4/8.14.4/y.out) with ESMTP id s2AIQ9bh010840 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL) for <kitten@ietf.org>; Mon, 10 Mar 2014 11:26:09 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=yahoo-inc.com; s=cobra; t=1394475969; bh=Y+BOYnlVijTrYVw3A3id8QSBIJR5f/WMY5Ri0P2+ErA=; h=References:Date:From:Reply-To:Subject:To:CC:In-Reply-To; b=u4yMHqy6AhUEthlyTkDJHz6MpeuDP8K8tDlJ/liJPrzQU5OF0lqYZCUnU6CKG4omX 0NO95+z6kbpzW0x5n+VpzM4cggfcHQEMHKrjzUddrRuLqsZH8a4IBLUN6UWbxC/rVF q96PddfLZ8JTEKc8JvAivUWV01TiDnBSCSZRjeEc=
Received: from omp1028.mail.ne1.yahoo.com (98.138.89.172) by GQ1-EX10-CAHT09.y.corp.yahoo.com (10.72.228.24) with Microsoft SMTP Server (TLS) id 14.3.181.6; Mon, 10 Mar 2014 11:26:07 -0700
Received: (qmail 12803 invoked by uid 1000); 10 Mar 2014 18:26:07 -0000
Received: (qmail 80846 invoked by uid 60001); 10 Mar 2014 18:26:07 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo-inc.com; s=ginc1024; t=1394475967; bh=41b7VKOfwqaQv1DcXFjvd+9EkYkIGXGWCz9SEMAHs1E=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:Cc:In-Reply-To:MIME-Version:Content-Type; b=EBiPXKw03CELFqJ9E39/pdifgXQzqEQnkH6Kza5O8HQco5iBvsE7WnB9YT0dZsr3zl7vrdLCjaXPJ3R/dYNETgW1+EGH/wNKH2rec2RKSmtbwSNyjFsy45+jQaC/uJKxC2Jej6P3zM1QwvCXX6kBKo7QgbGSLPjx94tKgdfKNLE=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=ginc1024; d=yahoo-inc.com; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:Cc:In-Reply-To:MIME-Version:Content-Type; b=GEfUmfqJ4XbatxLJ+xYThOC6uIHEOWB2TrGf37OPaEli32hIm9yUddtaeMXGP8obqWqIyfDREM2QvXlp2ANO2A2RO2osUdDiMn6Bevx7504adbSJb0Nshl/1nSGEuaZ72FdHFrbTUgyQSdNox+/RsLtNzrkeu0rp+c82CRVC2bc=;
X-YMail-OSG: V3kpCn8VM1ncww3pXJ9pFmnRztkSz6pWFV6rhdew94Bk8V9 sTDMBP7.Q7WBtrW8HiCQFezgaPHKeUyD1YBGtVdEueczPH9WsgwQZ5aeF8ok pSS1IUCb9.bgEE9_h4pQyfjvtV6BGqhdt5ZCMaucIn2T1YCERop6s6LGbzgd Pt_unxBL.enI1dh5UGJVMdb1hKfgTKwsNWmERjXnub.t7ePtWqSM8oHe43QR Uu..SXX5pjF5yQp3VoYjPEdu_JqECnIhxnkQee_.bU9hyT6eOM4JI4YSa8o3 6rZcS.rVmG.t5vnGah6ZdaulY
Received: from [209.131.62.115] by web125604.mail.ne1.yahoo.com via HTTP; Mon, 10 Mar 2014 11:26:07 PDT
X-Rocket-MIMEInfo: 002.001, TXkgaW50ZW50IGlzIHRvIG9ubHkgZG8gZW5vdWdoIGhlcmUgdG8gbWFrZSBzdXJlIHRoYXQgR1MyIGludGVyb3AgY2FuIHdvcmsgaW4gdGhlIGZ1dHVyZSBzaW5jZSB0aGVyZSBhcmUgZm9sa3MgdGhhdCBjYXJlLgoKCsKgCi1iaWxsCgoKCi0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tCldpbGxpYW0gSi4gTWlsbHMKIlBhcmFub2lkIiBNVVggWWFob28hCgoKCgoKT24gTW9uZGF5LCBNYXJjaCAxMCwgMjAxNCAxMToyMyBBTSwgIkNhbnRvciwgU2NvdHQiIDxjYW50b3IuMkBvc3UuZWR1PiB3cm90ZToBMAEBAQE-
X-Mailer: YahooMailWebService/0.8.177.636
References: <CF3FAF4D.4B1F4%cantor.2@osu.edu> <1394230922.9009.YahooMailAndroidMobile@web142803.mail.bf1.yahoo.com> <CAPe4Cjp6KSL5FsHVzNPMxvE_E4BmaWgEuZQVr_wEkexH=ukpAg@mail.gmail.com> <CF436DAF.4B41B%cantor.2@osu.edu> <CAK3OfOivZAPDsanf-MAuUxFtzd5+vy51fpuw6UCgohmZP-T3MQ@mail.gmail.com> <1394474177.99427.YahooMailNeo@web125601.mail.ne1.yahoo.com> <CF437606.4B428%cantor.2@osu.edu> <1394475268.88821.YahooMailNeo@web125603.mail.ne1.yahoo.com> <CF437A98.4B43D%cantor.2@osu.edu>
Message-ID: <1394475967.98405.YahooMailNeo@web125604.mail.ne1.yahoo.com>
Date: Mon, 10 Mar 2014 11:26:07 -0700
From: Bill Mills <wmills@yahoo-inc.com>
To: "Cantor, Scott" <cantor.2@osu.edu>, Nico Williams <nico@cryptonector.com>
In-Reply-To: <CF437A98.4B43D%cantor.2@osu.edu>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="-685807438-417484256-1394475967=:98405"
X-Milter-Version: master.31+4-gbc07cd5+
X-CLX-ID: 475969001
Archived-At: http://mailarchive.ietf.org/arch/msg/kitten/90Tntu6k1u_9Th7ji-3TjZRTS4k
Cc: "kitten@ietf.org" <kitten@ietf.org>
Subject: Re: [kitten] On SASL's authzid
X-BeenThere: kitten@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
Reply-To: Bill Mills <wmills@yahoo-inc.com>
List-Id: Common Authentication Technologies - Next Generation <kitten.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/kitten>, <mailto:kitten-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/kitten/>
List-Post: <mailto:kitten@ietf.org>
List-Help: <mailto:kitten-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/kitten>, <mailto:kitten-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 10 Mar 2014 18:26:35 -0000

My intent is to only do enough here to make sure that GS2 interop can work in the future since there are folks that care.


 
-bill



--------------------------------
William J. Mills
"Paranoid" MUX Yahoo!





On Monday, March 10, 2014 11:23 AM, "Cantor, Scott" <cantor.2@osu.edu> wrote:
 
On 3/10/14, 2:14 PM, "Bill Mills" <wmills@yahoo-inc.com> wrote:
>
>So we can leave it in user= and not define any GS2 header stuff beyond
>making sure the parsers handle it in the SASL side?

No, I'm saying you leave it out and let GS2 handle it, because it already
is.

>I got the impression from Sam that there's a case where a SASL mechanism
>talks to a GS2 server and it just works.  This sounded like it means that
>the authzid should be populated into the S2 header.

Yes. But that means you need to say nothing about it, unless I'm missing
something. You simply define in terms of GS2, so anything GS2 allows or
requires is there by definition.

That all assumes there's still a refernce to GS2 planned here. If that's
being tabled due to the lack of mutual-auth, and you're defining
essentially a GS2-like header that is compatible with it but not formally
GS2, then you would have to define it in this spec.


-- Scott

v2.46.0 | Report a Bug | By Email | System Status