Re: [kitten] Pending draft 15 Re: sasl-oauth "user" as a kvpair or in the gs2 header?

Seems reasonable.

The last sentence contains two typos.

-R

On Fri, Mar 14, 2014 at 2:52 PM, Bill Mills <wmills_92105@yahoo.com> wrote:

> Quoting here, in the hope that it piques someone's interest.  New proposed
> language is:
>
> " Client responses are a GS2 [RFC5801]<https://us-mg904.mail.yahoo.com/neo/launch?.rand=3v2pmo26m8nhi#RFC5801>
>  header followed by a key/value pair sequence, or may be empty. The
> gs2-header is defined here for compatibility with GS2 if a GS2 mechanism is
> formally defined, but this document does not define one. These key/value
> pairs carry the equivalent values from an HTTP context in order to be able
> to complete an OAuth style HTTP authorization. Unknown key/value pairs MUST
> be ignored by the server. The ABNF [RFC5234]<https://us-mg904.mail.yahoo.com/neo/launch?.rand=3v2pmo26m8nhi#RFC5234>
>  syntax is:
>
>
>   kvsep          = %x01
>   key            = 1*(ALPHA / ",")
>   value          = *(VCHAR / SP / HTAB / CR / LF )
>   kvpair         = key "=" value kvsep
> ;;gs2-header     = See RFC 5801
>   client_resp    = (gs2-header kvsep 0*kvpair kvsep) / kvsep
>
> The GS2 header MUST inclde the user name asociated with the resource being
> accessed, the "authzid"."
>
> Hoping to wrap this up soon.
>
> Thanks,
>
> -bill
>
>
>
>   On Wednesday, March 12, 2014 11:56 AM, Bill Mills <
> wmills_92105@yahoo.com> wrote:
>  Please take a look at the attached, specifically 3.1, and see if it
> captures what's been discussed.
>
> Thanks,
>
> -bill
>
>
>   On Thursday, March 6, 2014 3:38 PM, Ryan Troll <rtroll@googlers.com>
> wrote:
>  Apologies for the delay in responding.
>
> I understand this was discussed in today's meeting; and we're going to
> have a follow-up to discuss further - very reasonable.
>
> To answer Bill's original question: user= or a= --> Either works for us.
>  If one has better implications than the other, we'll use it.
>
> -R
>
>
>
> On Tue, Mar 4, 2014 at 7:55 AM, Bill Mills <wmills@yahoo-inc.com> wrote:
>
>
> It is not used as a SASL identity.  Quoting from -03 and -14 in progress:
> "user (REQUIRED):
> Contains the user name being authenticated. The server MAY use this as a
> routing or database lookup hint. The server MUST NOT use this as
> authoritative, the user name MUST be asserted by the OAuth credential."
>
> Also, looking at the Google API docs for XOAUTH2, they implemented based
> on the -03 spec and have the "user=$username" syntax.  See
> https://developers.google.com/gmail/xoauth2_protocol
>
> Based on Google's server API and the extant clients they have I'd like to
> ask for a consensus call on the following:
>
> 1) Add the -03 "user" kvpair back into the spec.
>
> a) YES or b) NO.
>
> 2) Should we include a GS2 header"
>
> a) No, let's wait for the GS2 update that deals with things that lack
> mutual auth and then write a spec that defines a GS2 header for SASL+OAUTH.
>
> b) Change the definition of "key" in kvpair to 1*(ALPHA / ",").  This
> makes a GS2 header followed by a ^A (i.e. "n,a=user@example.com^A") a
> valid kvpair which would be ignored by servers that don't understand it.
>
> c) Define a stub OPTIONAL GS2 header explicitly.
>
> d) Include a fully defined GS2 header (language from draft -10).
>
>
> My own feedback is 1: YES, 2: a or b.
>
> -bill
>
>
> --------------------------------
> William J. Mills
> "Paranoid" MUX Yahoo!
>
>
>
>   On Tuesday, March 4, 2014 12:06 AM, Sam Hartman <hartmans-ietf@mit.edu>
> wrote:
>  t's discuss Thursday.
> I'd like to understand what the user= value signifies and whether it's
> actually a SASL authorization identifier.
>
> I'd like to understand whether there's value in an unprotected SASL
> authorization identifier.
>
>
>
>
>
>
> _______________________________________________
> Kitten mailing list
> Kitten@ietf.org
> https://www.ietf.org/mailman/listinfo/kitten
>
>
>
> _______________________________________________
> Kitten mailing list
> Kitten@ietf.org
> https://www.ietf.org/mailman/listinfo/kitten
>
>
>
> _______________________________________________
> Kitten mailing list
> Kitten@ietf.org
> https://www.ietf.org/mailman/listinfo/kitten
>
>
>