Re: [kitten] AD review of draft-ietf-kitten-sasl-oauth-21

[Bill Mills <[e-mail]>]

Everything up to the concrete example works for me.  The example is vaporware, I'd rather use a concrete one or leave it out.

Sent from Yahoo Mail on Android

From:"Stephen Farrell" <[e-mail]>
Date:Wed, Apr 29, 2015 at 14:05
Subject:Re: [kitten] AD review of draft-ietf-kitten-sasl-oauth-21



On 29/04/15 20:43, Benjamin Kaduk wrote:
> The server fully validates the client response before generating a server
> response; this will necessarily include the validation steps listed in the
> specification for the OAuth Access Token Type used.  However, additional
> validation steps may be needed, depending on the particular application
> protocol making use of SASL.  In particular, values included as kvpairs in
> the client response (such as host and port) which correspond to values
> known to the application by some other mechanism (such as an application
> protocol data unit or pre-configured values) MUST be validated to match
> between the initial client response and the the other source(s) of such
> information.  As a concrete example, when SASL is used over TLS, the
> hostname can be available via the Server Name Indication TLS extension;
> this hostname must be validated to match the value sent in the 'host'

Yep, that'd work I think.



S.