Re: [kitten] Request for feedback: draft-wibrown-ldapssotoken

Hi William,

It would be worth mentioning in a Security Considerations section that this protocol (like all bearer tokens) is vulnerable to replay attacks.

Cheers,
Luke

> On 5 Sep 2016, at 8:35 AM, William Brown <wibrown@redhat.com> wrote:
> 
> Hi,
> 
> I would like to ask for feedback on the submission
> draft-wibrown-ldapssotoken [0]. Section 4 deals with the SASL component
> of the submission. I have been advised by Alexey Melnikov that this
> seems similar to rfc7628 [1] and rfc6595 [2]. The main difference that I
> see is that these rfcs rely on the external OAuth and SAML provider for
> tokens. As well, they have GSSAPI integrations. The implementation I am
> suggesting here is for a much simpler cryptographically based token,
> that is for "small deployments" IE where no other SSO such as KRB5, SAML
> or others are available. It's much more targeted around the
> communication and authentication to a Directory Server: but there is no
> reason it couldn't be use for simple crypto token sign on in other
> applications. 
> 
> Thanks for your time and advice,
> 
> [0] https://datatracker.ietf.org/doc/draft-wibrown-ldapssotoken/
> [1] https://tools.ietf.org/html/rfc7628
> [2] https://tools.ietf.org/html/rfc6595
> 
> -- 
> Sincerely,
> 
> William Brown
> Software Engineer
> Red Hat, Brisbane
> _______________________________________________
> Kitten mailing list
> Kitten@ietf.org
> https://www.ietf.org/mailman/listinfo/kitten

--
www.lukehoward.com
soundcloud.com/lukehoward