Re: [kitten] RFC5801bis: relaxing GS2 requirements

[Nico Williams <[e-mail]>]

While we're at it, with the OAuth user= / a= issue in mind, I propose
that we add a notion of authzid to the GSS-API via a naming attribute.
 The initiator calls GSS_Set_name_attribute() on a NAME for itself or
the target (doesn't matter which, but we should decide which) to set
an authzid attribute's value.  The mechanism will return an error if
it cannot handle this, per-RFC6680, but if it can handle it, then it
will make it available to the acceptor as an attribute of the
initiator's name, which it can get with GSS_Get_name_attribute().

Then we modify GS2 to say that the a= attribute in the GS2 header may
be left out when a) the GSS mechanism doesn't support channel binding,
and b) accepts the authzid name attribute.

See http://tools.ietf.org/html/draft-williams-kitten-impersonation-naming-attr-00

Nico
--