[kitten] Relaying SASL to a Diameter backend, Realm Crossover

Rick van Rein <rick@openfortress.nl> Fri, 14 October 2022 17:14 UTC

Date: Fri, 14 Oct 2022 17:14:00 +0000
From: Rick van Rein <rick@openfortress.nl>
To: kitten@ietf.org
Message-ID: <20221014171400.GA7961@openfortress.nl>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
User-Agent: Mutt/1.5.20 (2009-06-14)
Archived-At: <https://mailarchive.ietf.org/arch/msg/kitten/UILGwAckOe4cduBbM9s2RYErrdU>
Subject: [kitten] Relaying SASL to a Diameter backend, Realm Crossover
Precedence: list

Hello,

The attached specification is (currently) on the Indendendent track,
but does something to SASL that may be useful for Kitten to have seen.

It defines an embedding for SASL into Diameter AVPs, and supports
relaying to a backend which runs under the domain (or ENUM tree)
to which the client wants to login.  This domain is validated over
TLS, DNSSEC and DANE and it is subsequently trusted to release a
username.

  * This uses Channel Binding to ensure the frontend that the
    client authenticates against;

  * Normally, relaying SASL is insecure, as it may break into a
    mailbox or other resource.  The trick is that Diameter is not
    a valuable resource to crack; it merely says "aye" or "nay".

This is a stretch -- both technically and in terms of user experience.
We are working towards "Bring Your Own IDentity" service, where users
can run their own IdP and use it anywhere, without local accounts.

Any feedback is kindly welcomed.  Kitten is not in London, I saw,
but I will be there and am open to dicussion.

All this is working well for us, so the plan is to move towards the
RFC Editor and acquire the AVP codes for Diameter.


Cheers,

Rick van Rein
InternetWide.org


   ----- 8< -------- 8< -------- 8< -------- 8< -------- 8< -----


A new version of I-D, draft-vanrein-diameter-sasl-07.txt
has been successfully submitted by Rick van Rein and posted to the
IETF repository.

Name:		draft-vanrein-diameter-sasl
Revision:	07
Title:		Realm Crossover for SASL and GSS-API via Diameter
Document date:	2022-10-14
Group:		Individual Submission
Pages:		25
URL:            https://www.ietf.org/archive/id/draft-vanrein-diameter-sasl-07.txt
Status:         https://datatracker.ietf.org/doc/draft-vanrein-diameter-sasl/
Htmlized:       https://datatracker.ietf.org/doc/html/draft-vanrein-diameter-sasl
Diff:           https://www.ietf.org/rfcdiff?url2=draft-vanrein-diameter-sasl-07

Abstract:
   SASL and GSS-API are used for authentication in many application
   protocols.  This specification extends them to allow credentials of
   an identity domain to be used against external services.  To this
   end, it introduces end-to-end encryption for SASL that is safe to
   relay through a foreign server.

[kitten] Relaying SASL to a Diameter backend, Rea… Rick van Rein