[kitten] Pending draft 15 Re: sasl-oauth "user" as a kvpair or in the gs2 header?

[Bill Mills <[e-mail]>]

Please take a look at the attached, specifically 3.1, and see if it captures what's been discussed.

Thanks,

-bill



On Thursday, March 6, 2014 3:38 PM, Ryan Troll <[e-mail]> wrote:
 
Apologies for the delay in responding.

I understand this was discussed in today's meeting; and we're going to have a follow-up to discuss further - very reasonable.

To answer Bill's original question: user= or a= --> Either works for us.  If one has better implications than the other, we'll use it.

-R




On Tue, Mar 4, 2014 at 7:55 AM, Bill Mills <[e-mail]> wrote:


>
>It is not used as a SASL identity.  Quoting from -03 and -14 in progress:
>
>"user (REQUIRED):
>
>
>Contains the user name being 
authenticated.  The server MAY use this as a routing or database lookup 
hint.  The server MUST NOT use this as authoritative, the user name MUST be asserted by the OAuth credential."
> 
>Also, looking at the Google API docs for XOAUTH2, they implemented based on the -03 spec and have the "user=$username" syntax.  See https://developers.google.com/gmail/xoauth2_protocol 
>
>Based on Google's server API and the extant clients they have I'd like to ask for a consensus call on the following:
>
>1) Add the -03 "user" kvpair back into the spec.
>
>a) YES or b) NO.  
>
>2) Should we include a GS2 header"
>
>a) No, let's wait for the GS2 update that deals with things that lack mutual auth and then write a spec that defines a GS2 header for SASL+OAUTH.
>
>b) Change the definition of "key" in kvpair to 1*(ALPHA / ",").  This makes a GS2 header followed by a ^A (i.e.
 "n,a=[e-mail]^A") a valid kvpair which would be ignored by servers that don't understand it. 
>
>c) Define a stub OPTIONAL GS2 header explicitly.
>
>d) Include a fully
 defined GS2 header (language from draft -10).
>
>
>My own feedback is 1: YES, 2: a or b.
>
>
>-bill
>
>
>
>--------------------------------
>William J. Mills
>"Paranoid" MUX Yahoo!
>
>
>
>
>
>
>On Tuesday, March 4, 2014 12:06 AM, Sam Hartman <[e-mail]> wrote:
> 
>t's discuss Thursday.
>I'd like to understand what the user= value signifies and whether it's
>actually a SASL authorization identifier.
>
>I'd like to understand whether there's value in an unprotected SASL
>authorization identifier.
>
>
>
>
>
>
>_______________________________________________
>Kitten mailing list
>[e-mail]
>https://www.ietf.org/mailman/listinfo/kitten
>
>


_______________________________________________
Kitten mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/kitten