IETF Logo Mail Archive

Re: [kitten] Fw: New Version Notification for draft-mills-kitten-sasl-oauth-02

"Cantor, Scott E." <cantor.2@osu.edu> Fri, 08 April 2011 19:25 UTC

Return-Path: <cantor.2@osu.edu>
X-Original-To: kitten@core3.amsl.com
Delivered-To: kitten@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 06E9D3A69E2 for <kitten@core3.amsl.com>; Fri, 8 Apr 2011 12:25:46 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.531
X-Spam-Level:
X-Spam-Status: No, score=-3.531 tagged_above=-999 required=5 tests=[AWL=0.068, BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uIUAPAZKOENa for <kitten@core3.amsl.com>; Fri, 8 Apr 2011 12:25:45 -0700 (PDT)
Received: from defang12.it.ohio-state.edu (defang12.it.ohio-state.edu [128.146.216.21]) by core3.amsl.com (Postfix) with ESMTP id 12F8E3A6975 for <kitten@ietf.org>; Fri, 8 Apr 2011 12:25:44 -0700 (PDT)
Received: from CIO-TNC-HT06.osuad.osu.edu (cio-tnc-ht06.osuad.osu.edu [164.107.81.171]) by defang12.it.ohio-state.edu (8.13.7/8.13.1) with ESMTP id p38JRT1I024119; Fri, 8 Apr 2011 15:27:29 -0400
Received: from CIO-KRC-D1MBX01.osuad.osu.edu ([fe80::450b:35e6:80f4:f3e0]) by CIO-TNC-HT06.osuad.osu.edu ([fe80::fc4d:697c:5243:fd03%13]) with mapi; Fri, 8 Apr 2011 15:23:40 -0400
From: "Cantor, Scott E." <cantor.2@osu.edu>
To: Sam Hartman <hartmans-ietf@mit.edu>
Thread-Topic: [kitten] Fw: New Version Notification for draft-mills-kitten-sasl-oauth-02
Thread-Index: AQHL9h27eQZ1CqEixkWSNA9dnCkCrJRUWMrw
Date: Fri, 08 Apr 2011 19:27:45 +0000
Message-ID: <7EE86E89365CA94F8E7B8251F926071007AC141F@CIO-KRC-D1MBX01.osuad.osu.edu>
References: <20110408070506.12ECB3A6A4C@core3.amsl.com> <416848.75882.qm__16525.0710481361$1302247955$gmane$org@web32314.mail.mud.yahoo.com> <87hba9b13i.fsf@latte.josefsson.org> <tsl4o684s5q.fsf@mit.edu> <754979.46407.qm@web32303.mail.mud.yahoo.com> <tslr59c3asv.fsf@mit.edu> <7EE86E89365CA94F8E7B8251F926071007AC12BC@CIO-KRC-D1MBX01.osuad.osu.edu> <tslipuo378b.fsf@mit.edu>
In-Reply-To: <tslipuo378b.fsf@mit.edu>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-CanIt-Geo: ip=164.107.81.171; country=US; region=OH; city=Columbus; latitude=39.9968; longitude=-82.9882; metrocode=535; areacode=614; http://maps.google.com/maps?q=39.9968,-82.9882&z=6
X-CanItPRO-Stream: outbound
X-Scanned-By: CanIt (www . roaringpenguin . com) on 128.146.216.21
Cc: "kitten@ietf.org" <kitten@ietf.org>, Simon Josefsson <simon@josefsson.org>, Tim Showalter <timshow@yahoo-inc.com>
Subject: Re: [kitten] Fw: New Version Notification for draft-mills-kitten-sasl-oauth-02
X-BeenThere: kitten@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Common Authentication Technologies - Next Generation <kitten.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/kitten>, <mailto:kitten-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/kitten>
List-Post: <mailto:kitten@ietf.org>
List-Help: <mailto:kitten-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/kitten>, <mailto:kitten-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 08 Apr 2011 19:25:46 -0000

>     Cantor,> How is it expected that servers would distinguish clients
> 
> I'd expect that is what the SASL authentication is for.
> (Note that HTTP is more complex; you need cookies or some other
> distinguisher there).

I think my confusion stems from both thinking about HTTP and also thinking about SSL session resumption across TCP connections (which is somewhat related to the HTTP thing).

> Unless I'm missing something (wouldn't be the first time) I think 1 and
> 2 are sufficient for a non-HTTP use case.

It's sufficient for a persistent connection. I think you answered the other case by mentioning cookies. Normally that has a fairly perjorative connotation, but since the client here isn't a browser (read browser as "security sinkhole"), such a cookie isn't a cookie in the "anybody can probably steal it" sense.

-- Scott

v2.23.0 | Report a Bug | By Email