IETF Logo Mail Archive

Re: [kitten] SASL as authmode for HTTP and SIP

Rick van Rein <rick@openfortress.nl> Sat, 15 October 2022 19:15 UTC

Return-Path: <vanrein@vanrein.org>
X-Original-To: kitten@ietfa.amsl.com
Delivered-To: kitten@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7B843C14F719 for <kitten@ietfa.amsl.com>; Sat, 15 Oct 2022 12:15:29 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -6.646
X-Spam-Level:
X-Spam-Status: No, score=-6.646 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.249, RCVD_IN_DNSWL_HI=-5, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, T_SCC_BODY_TEXT_LINE=-0.01, T_SPF_TEMPERROR=0.01, URIBL_BLOCKED=0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=kpnmail.nl
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FI6lQNF7DGSr for <kitten@ietfa.amsl.com>; Sat, 15 Oct 2022 12:15:22 -0700 (PDT)
Received: from ewsoutbound.kpnmail.nl (ewsoutbound.kpnmail.nl [195.121.94.170]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 25D4BC14F606 for <kitten@ietf.org>; Sat, 15 Oct 2022 12:15:08 -0700 (PDT)
X-KPN-MessageId: a92f7d77-4cbd-11ed-8a67-005056ab378f
Received: from smtp.kpnmail.nl (unknown [10.31.155.39]) by ewsoutbound.so.kpn.org (Halon) with ESMTPS id a92f7d77-4cbd-11ed-8a67-005056ab378f; Sat, 15 Oct 2022 21:14:58 +0200 (CEST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kpnmail.nl; s=kpnmail01; h=content-type:mime-version:message-id:subject:to:from:date; bh=W3eMiPVLRB533+isAFrlWsvgfrF/YTvJAQK5SvBwBq0=; b=ki5Uc6CSKV+CVrRBwBxol2XJZ220D+b7iT0ClLQaz/txkh4QTv1FrfaniDD0tt2CdonEGeKSBxKYx HlRgJrcKJdox/0e0aQfTf+HaLSRHDEmSNmyTfLHHTv37FYAzm1O/gidOWle5AuMhT3una/fl9+m010 tJ5T2Ienn49NoQMA=
X-KPN-MID: 33|cB1ongb7eN6KKZS5u+4tC5STZl9WI3SkOrLCUow8nk5eKRybnkYikEjzTjViTAz J12Cu7osT+aVeQq4gvYLAk/a/2bHZSA0Uls/K2rxYTeQ=
X-KPN-VerifiedSender: No
X-CMASSUN: 33|U5aFlvXhMKBq7ZJUvKtgRVJoWSoWlNvhNvZcRUpWXg9kPJjzM0ML2CnNoM93DUf /CeBORPVU5xfruvYvg0sysA==
X-Originating-IP: 77.173.183.203
Received: from fame.vanrein.org (77-173-183-203.fixed.kpn.net [77.173.183.203]) by smtp.xs4all.nl (Halon) with ESMTPSA id adb19ea8-4cbd-11ed-b8b1-005056ab7447; Sat, 15 Oct 2022 21:15:06 +0200 (CEST)
Received: by fame.vanrein.org (Postfix, from userid 1000) id 550B229D42; Sat, 15 Oct 2022 19:15:06 +0000 (UTC)
Date: Sat, 15 Oct 2022 19:15:06 +0000
From: Rick van Rein <rick@openfortress.nl>
To: Stefan Marsiske <03cx8i55f6@ctrlc.hu>
Cc: Ken Hornstein <kenh@pobox.com>, kitten@ietf.org
Message-ID: <20221015191506.GA11187@openfortress.nl>
References: <20221014171909.GB7961@openfortress.nl> <20221014231838.8881E16156F@pb-smtp2.pobox.com> <Y0nxyhwV75SoBuvB@localhost>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <Y0nxyhwV75SoBuvB@localhost>
User-Agent: Mutt/1.5.20 (2009-06-14)
Archived-At: <https://mailarchive.ietf.org/arch/msg/kitten/9SEkpG93OX7eP00y1scwqIpKkRk>
Subject: Re: [kitten] SASL as authmode for HTTP and SIP
X-BeenThere: kitten@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: Common Authentication Technologies - Next Generation <kitten.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/kitten>, <mailto:kitten-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/kitten/>
List-Post: <mailto:kitten@ietf.org>
List-Help: <mailto:kitten-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/kitten>, <mailto:kitten-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 15 Oct 2022 19:15:29 -0000

Hi,

Sorry for the slow response, was busy elsewhere.

> the missing links:
> https://gitlab.com/arpa2/apachemod/-/tree/master/
> https://github.com/stef/ngx_http_auth_sasl_module/
> https://gitlab.com/arpa2/http_sasl_client

Thanks Stef!

> (i don't know which is the 2nd apache impl though)

There are two different implementations for Apache,

https://gitlab.com/arpa2/apachemod/-/tree/master/arpa2_sasl
	--> Uses Cyrus-SASL2 running on the HTTP server

https://gitlab.com/arpa2/apachemod/-/tree/master/arpa2_diasasl
	--> talks to a backend using the Quick-DiaSASL protocol
	    from draft-vanrein-diameter-sasl
	    https://datatracker.ietf.org/doc/html/draft-vanrein-diameter-sasl-07#appendix-A
	    which we use for Diameter callbacks to a client domain
	    (although it can also use Cyrus-SASL2 on the Diameter node).

> > I found the HTTP-SASL plugin for Nginx, and it seems straighforward.  But
> > I did not find a comparable one for Apache.  I did find mod_authn_sasl,

The modules are not in the mainstream Apache distribution, that is correct.
But they work, and implement the drafts faithfully, is what I subjectively
said.

> it's not native. it's just a webextension (see above). and it only works with
> manifestv2 - thus no chrom* support.

Yes, of course.  It's virtually impossible getting anything into browsers,
certainly before a standard exists.


Sorry for not supplying the links immediately, my intention was to be
terse and focus on the specs.  Let me know if you have more questions!


Cheers,
 -Rick

v2.23.0 | Report a Bug | By Email