Re: [kitten] Pending draft 15 Re: sasl-oauth "user" as a kvpair or in the gs2 header?

[Bill Mills <[e-mail]>]

OK, so given Google's extant implementation, if we change it to SHOULD the MUST is implicit and the de facto standard anyway if you want it to work with Google.


I'd rather have the standard explicitly document what is working now, but I can make the change easily.

 
-bill



--------------------------------
William J. Mills
"Paranoid" MUX Yahoo!





On Monday, March 17, 2014 1:32 PM, Matt Miller <[e-mail]> wrote:
 
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 3/17/14, 2:13 PM, Nico Williams wrote:
> On Fri, Mar 14, 2014 at 4:52 PM, Bill Mills
> <[e-mail]> wrote:
>> Quoting here, in the hope that it piques someone's interest.  New
>> proposed language is:
>> 
>> " Client responses are a GS2 [RFC5801] header followed by a
>> key/value pair sequence, or may be empty. The gs2-header is
>> defined here for compatibility with GS2 if a GS2 mechanism is
>> formally defined, but this document does not
> 
> s/formally/eventually/ ?
> 
>> define one. These key/value pairs carry the equivalent values
>> from an HTTP context in order to be able to complete an OAuth
>> style HTTP authorization. Unknown key/value pairs MUST be ignored
>> by the server. The ABNF [RFC5234] syntax is:
>> 
>> 
>> kvsep          = %x01 key            = 1*(ALPHA / ",") value
>> = *(VCHAR / SP / HTAB / CR / LF ) kvpair         = key "=" value
>> kvsep ;;gs2-header     = See RFC 5801 client_resp    =
>> (gs2-header kvsep 0*kvpair kvsep) / kvsep
>> 
>> The GS2 header MUST inclde the user name asociated with the
>> resource being accessed, the "authzid"."
> 
> Hmm, MUST?  SASL allows the app to not use an authzid if it
> doesn't want to.  I understand that Google's OAuth use case
> requires an authzid, but it's not obvious to me that all OAuth use
> cases will.
> 
> + the two typos Ryan noticed.
> 

I had the same pause as Nico.  The implementation I was looking into
did not require such information.



- -- 
- - m&m

Matt Miller < [e-mail] >
Cisco Systems, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.22 (Darwin)
Comment: GPGTools - https://gpgtools.org
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQEcBAEBCgAGBQJTJ1vBAAoJEDWi+S0W7cO1GbIH/jB145C0XvBjgngGNcVKs/Be
15zEdvojCNdDY0wHdjUXbwIbWs7LHA5ltO8NJhUVLU8E+Rmjl6ow+GvtlwqxCEFm
IogrbU3uLEtB2liMGXBxLk2u4SbMV92e8g0WNQ7Qmo5Yws8urzkBFrcIG/Yu2gbe
yUjvp8ai1E7o3y6xBZtzgZqIebF063mVMRGXJvIR5Z5DcgjQ0UMW0GLhGslYX6yB
+pQ+faA2IsTDIVVBuOu9weP8mwgxU2tqtMcxe7ffWy1iPZrxk21pLvVmHL4sLHXO
4znnhsGApj+OzDojLPXh2jEdGOiO2goz2DWcV04rqpMSeMjLYK7jLw3N0YqMMZw=
=W7/c
-----END PGP SIGNATURE-----