Re: [kitten] Ben Campbell's No Objection on draft-ietf-kitten-sasl-oauth-22: (with COMMENT)

Benjamin Kaduk <kaduk@MIT.EDU> Thu, 28 May 2015 03:56 UTC

Return-Path: <kaduk@mit.edu>
X-Original-To: kitten@ietfa.amsl.com
Delivered-To: kitten@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 864961A1B8F; Wed, 27 May 2015 20:56:26 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.211
X-Spam-Level:
X-Spam-Status: No, score=-4.211 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JyKGmJxwZsYe; Wed, 27 May 2015 20:56:24 -0700 (PDT)
Received: from dmz-mailsec-scanner-7.mit.edu (dmz-mailsec-scanner-7.mit.edu [18.7.68.36]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2E7EB1A1A72; Wed, 27 May 2015 20:56:24 -0700 (PDT)
X-AuditID: 12074424-f79b06d000000cfd-40-556691e68254
Received: from mailhub-auth-3.mit.edu ( [18.9.21.43]) (using TLS with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by dmz-mailsec-scanner-7.mit.edu (Symantec Messaging Gateway) with SMTP id FD.F4.03325.7E196655; Wed, 27 May 2015 23:56:23 -0400 (EDT)
Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) by mailhub-auth-3.mit.edu (8.13.8/8.9.2) with ESMTP id t4S3uLO1021100; Wed, 27 May 2015 23:56:22 -0400
Received: from multics.mit.edu (system-low-sipb.mit.edu [18.187.2.37]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.13.8/8.12.4) with ESMTP id t4S3uHCH002849 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Wed, 27 May 2015 23:56:18 -0400
Received: (from kaduk@localhost) by multics.mit.edu (8.12.9.20060308) id t4S3uGVo028803; Wed, 27 May 2015 23:56:16 -0400 (EDT)
Date: Wed, 27 May 2015 23:56:16 -0400 (EDT)
From: Benjamin Kaduk <kaduk@MIT.EDU>
To: Ben Campbell <ben@nostrum.com>
In-Reply-To: <7F67E244-0ED2-473E-9E5A-B8E2B382563B@nostrum.com>
Message-ID: <alpine.GSO.1.10.1505272351080.22210@multics.mit.edu>
References: <20150527211918.9536.15611.idtracker@ietfa.amsl.com> <1717038366.5795.1432766943755.JavaMail.yahoo@mail.yahoo.com> <7F67E244-0ED2-473E-9E5A-B8E2B382563B@nostrum.com>
User-Agent: Alpine 1.10 (GSO 962 2008-03-14)
MIME-Version: 1.0
Content-Type: MULTIPART/MIXED; BOUNDARY="-559023410-402023201-1432785376=:22210"
X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFlrFKsWRmVeSWpSXmKPExsUixCmqrft8YlqowZ757BbzO0+zW/w98pvZ 4uGMg4wW0x98YbKY8Wcis8W13ftZLY5uXsVi8a3rOrMDh8eSJT+ZPGbtfMLiMWvWYaYA5igu m5TUnMyy1CJ9uwSujH1TVzEWfBapmPD0CFsD42WBLkZODgkBE4l5j7axQNhiEhfurWfrYuTi EBJYzCRx4sx2FghnI6PEjtnLWCGcQ0wSmx9NZYRwGhglPl5dywjSzyKgLXH50hw2EJtNQEVi 5puNYLaIgJLE8+atYKOYBS4yS2zZuQXI4eAQFkiTaHuQBlLDKWAv8fh7MzuIzSvgKPH/SgMr 3Oq3nTdZQRKiAjoSq/dPYYEoEpQ4OfMJmM0sECAxa+1R1gmMgrOQpGYhSUHY6hKND86yQdja EvdvtrEtYGRZxSibklulm5uYmVOcmqxbnJyYl5dapGuul5tZopeaUrqJERQl7C4qOxibDykd YhTgYFTi4X0hnxYqxJpYVlyZe4hRkoNJSZTXrg8oxJeUn1KZkVicEV9UmpNafIhRgoNZSYT3 iydQjjclsbIqtSgfJiXNwaIkzrvpB1+IkEB6YklqdmpqQWoRTFaGg0NJgtdqAlCjYFFqempF WmZOCUKaiYMTZDgP0PA2kBre4oLE3OLMdIj8KUZFKXHeRJCEAEgiozQPrheWxF4xigO9Isyb DVLFA0yAcN2vgAYzAQ02O5oCMrgkESEl1cAYF/ni4ZYXMmr3bTsPHZqj9IZzu9IyJ/6n/1lX p8X373o2WXvSq98nnhlEqAhtPNl0Rp7X6+PHiPC9W75rzLMXYpfpjdH0vpl72rNeZvGrRy6T lJc1R31i4tG/tzx03+cHDZlHpLefFJr69Mr8zzU72g9nF7JXrTyY0cjxuELLqGvTlSOcPSc5 lViKMxINtZiLihMBk3LUnT0DAAA=
Archived-At: <http://mailarchive.ietf.org/arch/msg/kitten/anb78e_p_WTUunLakOLHOSjG_T4>
Cc: "kitten-chairs@ietf.org" <kitten-chairs@ietf.org>, "draft-ietf-kitten-sasl-oauth.shepherd@ietf.org" <draft-ietf-kitten-sasl-oauth.shepherd@ietf.org>, "kitten@ietf.org" <kitten@ietf.org>, The IESG <iesg@ietf.org>, "draft-ietf-kitten-sasl-oauth@ietf.org" <draft-ietf-kitten-sasl-oauth@ietf.org>, "draft-ietf-kitten-sasl-oauth.ad@ietf.org" <draft-ietf-kitten-sasl-oauth.ad@ietf.org>
Subject: Re: [kitten] Ben Campbell's No Objection on draft-ietf-kitten-sasl-oauth-22: (with COMMENT)
X-BeenThere: kitten@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Common Authentication Technologies - Next Generation <kitten.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/kitten>, <mailto:kitten-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/kitten/>
List-Post: <mailto:kitten@ietf.org>
List-Help: <mailto:kitten-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/kitten>, <mailto:kitten-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 28 May 2015 03:56:26 -0000

Hi Ben,

On Wed, 27 May 2015, Ben Campbell wrote:

> Hi, thanks for the response. A few comments below. I removed sections that do
> not seem to need further discussion.
>
> On 27 May 2015, at 17:49, Bill Mills wrote:
>
> [...]
>
> > >  > -- 3: "Such a new SASL OAuth mechanism can be added by simply>  
> > >  registering the new name(s)"> > Register them where?
> > s/by simply registering the new name(s)/by registering the new name(s) with
> > IANA/
> > change made in my working copy.
>
> Sorry, I guess I was asking for which registry at IANA.

The SASL Mechanisms registry; the only one affected by this document.

> > >  > -- 3.2, 2nd paragraph : "... known to the application."> > Known to the
> > > "resource server"?
> > this is server config and in protocol data that the app could have, so I'd
> > rather leave this as "application" but if there's strong desire for
> > "resource server" I'll make the change.
>
> Do I understand correctly that we are talking about matching things like host
> and port sent by the client to things the server "knows" through other
> channels?  It seems like "application" could mean application at the client as
> well as the server, or even the combination of both. Maybe "application
> server"? (Or maybe I've missed the intent?)

Things like host and port that could be extracted from the OS or http
stack or similar, yes.  I don't particularly care for "resource server"
here, but "application server" seems unobjectionable.

> > >  > Editorial Stuff:> > -- 3.1, "Port":> > I assume that means the
> > > destination port to which the client connected?> (similar to Host?)> > --
> > > 3.1.1 "Post": default value is "". > > Does "" represent an empty string?
> > Yes, does this need to be spelled out?
>
> "Need" might be too strong a word, but I think a description like "empty"
> would be more clear than '""'.

I agree that it's probably worth doing "destination port to which the
client connected".  I have no strong feelings regarding the way in which
the empty string is described.

> > >  > -- 3.2, first sentence"> > s/" ... according the specification..." /
> > > "... according to the specification..."
>
> [...]

Indeed.

-Ben