Re: [kitten] Pending draft 15 Re: sasl-oauth "user" as a kvpair or in the gs2 header?

[Bill Mills <[e-mail]>]

Fixed. Thanks.



On Monday, March 17, 2014 10:14 AM, Ryan Troll <[e-mail]> wrote:
 
Seems reasonable.

The last sentence contains two typos.

-R



On Fri, Mar 14, 2014 at 2:52 PM, Bill Mills <[e-mail]> wrote:

Quoting here, in the hope that it piques someone's interest.  New proposed language is:
>
>
>" Client responses are a GS2 [RFC5801] header followed by a key/value pair sequence, or may be empty. The gs2-header is defined here for compatibility with GS2 if a GS2 mechanism is formally defined, but this document does not define one. These key/value pairs carry the equivalent values from an HTTP context in order to be able to complete an OAuth style HTTP authorization. Unknown key/value pairs MUST be ignored by the server. The ABNF [RFC5234] syntax is:
>kvsep          = %x01 key            = 1*(ALPHA / ",") value          = *(VCHAR / SP / HTAB / CR / LF ) kvpair         = key "=" value kvsep
;;gs2-header     = See RFC 5801 client_resp    = (gs2-header kvsep 0*kvpair kvsep) / kvsep 
>The GS2 header MUST inclde the user name asociated with the resource being accessed, the "authzid"."
>
>
>Hoping to wrap this up soon.
>
>
>Thanks,
>
>
>-bill
>
>
>
>
>
>On Wednesday, March 12, 2014 11:56 AM, Bill Mills <[e-mail]> wrote:
> 
>Please take a look at the attached, specifically 3.1, and see if it captures what's been discussed.
>
>
>Thanks,
>
>
>-bill
>
>
>
>On Thursday, March 6, 2014 3:38 PM, Ryan Troll <[e-mail]> wrote:
> 
>Apologies for the delay in responding.
>
>
>I understand this was discussed in today's meeting; and we're going to have a follow-up to discuss further - very reasonable.
>
>
>To answer Bill's original question: user= or a= --> Either works for us.  If one has better implications than the other, we'll use it.
>
>
>-R
>
>
>
>
>
>On Tue, Mar 4, 2014 at 7:55 AM, Bill Mills <[e-mail]> wrote:
>
>
>>
>>It is not used as a SASL identity.  Quoting from -03 and -14 in progress:
>>
>>"user (REQUIRED):
>>
>>
>>Contains the user name being 
authenticated.  The server MAY use this as a routing or database lookup 
hint.  The server MUST NOT use this as authoritative, the user name MUST be asserted by the OAuth credential."
>> 
>>Also, looking at the Google API docs for XOAUTH2, they implemented based on the -03 spec and have the "user=$username" syntax.  See https://developers.google.com/gmail/xoauth2_protocol 
>>
>>Based on Google's server API and the extant clients they have I'd like to ask for a consensus call on the following:
>>
>>1) Add the -03 "user" kvpair back into the spec.
>>
>>a) YES or b) NO.  
>>
>>2) Should we include a GS2 header"
>>
>>a) No, let's wait for the GS2 update that deals with things that lack mutual auth and then write a spec that defines a GS2 header for SASL+OAUTH.
>>
>>b) Change the definition of "key" in kvpair to 1*(ALPHA / ",").  This makes a GS2 header followed by a ^A (i.e.
 "n,a=[e-mail]^A") a valid kvpair which would be ignored by servers that don't understand it. 
>>
>>c) Define a stub OPTIONAL GS2 header explicitly.
>>
>>d) Include a fully
 defined GS2 header (language from draft -10).
>>
>>
>>My own feedback is 1: YES, 2: a or b.
>>
>>
>>-bill
>>
>>
>>
>>--------------------------------
>>William J. Mills
>>"Paranoid" MUX Yahoo!
>>
>>
>>
>>
>>
>>
>>On Tuesday, March 4, 2014 12:06 AM, Sam Hartman <[e-mail]> wrote:
>> 
>>t's discuss Thursday.
>>I'd like to understand what the user= value signifies and whether it's
>>actually a SASL authorization identifier.
>>
>>I'd like to understand whether there's value in an unprotected SASL
>>authorization identifier.
>>
>>
>>
>>
>>
>>
>>_______________________________________________
>>Kitten mailing list
>>[e-mail]
>>https://www.ietf.org/mailman/listinfo/kitten
>>
>>
>
>
>_______________________________________________
>Kitten mailing list
>[e-mail]
>https://www.ietf.org/mailman/listinfo/kitten
>
>
>
>_______________________________________________
>Kitten mailing list
>[e-mail]
>https://www.ietf.org/mailman/listinfo/kitten
>
>
>