Re: [kitten] On SASL's authzid

[Chris Newman <[e-mail]>]

--On March 6, 2014 20:05:39 -0600 Nico Williams <[e-mail]> 
wrote:
> Q: What is it?  It is:
>
> My answer, as I understand it the authzid is:
>
>  - an advisory, application-specific value sent by the client inside
> the SASL mechanism's messages (i.e., protected by the mechanism, if
> the mechanism can do it)
>
> and
>
>  - notionally it's the name of a resource (user account, mailbox, ...)
> that the client wants to access or access things as.

SASL has two identities: "the user whose credentials are provided" 
(authentication id) and "the user to login/authenticate as" (authorization 
id). The former is in a namespace determined by the underlying identity 
system. Some mechanisms, like Kerberos, force a namespace on the identity 
system. Some mechanisms, like PLAIN, tend to work with a wide variety of 
identity systems. The authorization id is in a namespace determined by the 
application consuming SASL. Both of these identities are often user@host 
syntax in practice, but there are exceptions (e.g., LDAP DNs).

Two common scenarios for authorization identity are: using administrative 
credentials to login as another user, or a secretary using her credentials 
to login as her boss.

If the supplied credentials are not authorized to login as the 
authorization identity, that should result in a SASL failure (with an 
authorization failed error code if the enclosing protocol has one).

> Q: Why do we care about fitting things into the authzid?
>
> My answer: because we don't want mechanisms to force new _required_
> input elements on existing SASL APIs.

I do not consider this an important design consideration, although it may 
be desirable to improve deployability of a mechanism. SASL's important 
function is a protocol design abstraction -- allowing an authentication 
mechanism suitable for multiple protocols to be encapsulated in multiple 
protocols without having to write how to do it separately for each one. 
Using a SASL API is completely optional and I've seen several cases where I 
consider SASL API usage harmful.

		- Chris