IETF Logo Mail Archive

Re: [kitten] On SASL's authzid

Bill Mills <wmills@yahoo-inc.com> Mon, 10 March 2014 17:56 UTC

Return-Path: <wmills@yahoo-inc.com>
X-Original-To: kitten@ietfa.amsl.com
Delivered-To: kitten@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D93E91A0262 for <kitten@ietfa.amsl.com>; Mon, 10 Mar 2014 10:56:59 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -16.92
X-Spam-Level:
X-Spam-Status: No, score=-16.92 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_NEUTRAL=0.779, USER_IN_DEF_WHITELIST=-15] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lXsd9WHRCMho for <kitten@ietfa.amsl.com>; Mon, 10 Mar 2014 10:56:57 -0700 (PDT)
Received: from mrout2.yahoo.com (mrout2.yahoo.com [216.145.54.172]) by ietfa.amsl.com (Postfix) with ESMTP id DBD761A04AB for <kitten@ietf.org>; Mon, 10 Mar 2014 10:56:57 -0700 (PDT)
Received: from GQ1-EX10-CAHT14.y.corp.yahoo.com (gq1-ex10-caht14.corp.gq1.yahoo.com [10.73.119.195]) by mrout2.yahoo.com (8.14.4/8.14.4/y.out) with ESMTP id s2AHuJf5042213 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL) for <kitten@ietf.org>; Mon, 10 Mar 2014 10:56:20 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=yahoo-inc.com; s=cobra; t=1394474180; bh=wOBih7u+ekbq4xwWAMqJZD6ZU0/CZ/XCPz4F7kDojLE=; h=References:Date:From:Reply-To:Subject:To:CC:In-Reply-To; b=lNrQV9o0AvcTppIqlrH9N18DFolWFAoJS24nYW4p0jr11FgI25kwDDEvx5+JD4UCI NvocwRoJuyOXrlyKORrAOPXbbvNldxX4rEQlXtz4TRvGF4x4cwGxCAtBnPLpnXuFMn L8QfQXVGlVHcEN/TqmBeixXTbCyFN6FHd8BGEwTE=
Received: from omp1041.mail.ne1.yahoo.com (98.138.89.249) by GQ1-EX10-CAHT14.y.corp.yahoo.com (10.72.228.24) with Microsoft SMTP Server (TLS) id 14.3.181.6; Mon, 10 Mar 2014 10:56:18 -0700
Received: (qmail 52218 invoked by uid 1000); 10 Mar 2014 17:56:18 -0000
Received: (qmail 21667 invoked by uid 60001); 10 Mar 2014 17:56:17 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo-inc.com; s=ginc1024; t=1394474177; bh=miSbb2g1yl42rbHFzF9Fs2S51FSdqIWM4sheDrWQx6A=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:Cc:In-Reply-To:MIME-Version:Content-Type; b=aRDRHzNEDEjugEIzfut2ZiibrfhcNXI3i4XoyBI1Ypi75BJmrn14cWd+x7+dNO+sn3olAgLtzU7lIQFqqQBtiuBaWNOte73W/lprarTkvkNirhf88zwGOE4gFjYCvUvOOaHhCJIXpjCZ1xQWlhRlBmFP1Dwdo4IF7qqsExiT4Xc=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=ginc1024; d=yahoo-inc.com; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:Cc:In-Reply-To:MIME-Version:Content-Type; b=VsymPrX2V/xV03cIsCJ4sVIfV7k3e/2tI6/rLSNT8iOnnMWvN7KR4YWkDELAcT6QWkXTdhrfytjDYvZd1des+xgQAoGUklWsMv50vKhEH1y+DzV06V3oV+EfUPgF/YpFkMMX0fvLsVCYTuzEcBFPkdyfnMU+EWuWBGMsJ0llFSw=;
X-YMail-OSG: bL3A0roVM1lgUgtGNbQShAiZYDCfYTmynK6goxkwE7.blNS Jyz.ywfY2E98A9XWOGJ_a5T6OtWNVeoar54GXIwGWDg7.6QWh6pMg7BZEPdB k9DFyW2TfKQLMFSD_DGWrbT1RHdiT5NxTryyQHIO3AOQI51sZWlWj5cjN.Xo 11DUWS.TBCCjkgAlBzfq0goHOJtSpTjuCLAEKkoz7mMMVMHLmfVPiw9gWtEF 3PlHC1mwmJhfGg06mSPXMrJdPYbp9IzN.Gqr_k.VRq4tF4i7718LJ3SVbbG4 bm3hJ4cSZT6Ga6vsHnfA-
Received: from [209.131.62.115] by web125601.mail.ne1.yahoo.com via HTTP; Mon, 10 Mar 2014 10:56:17 PDT
X-Rocket-MIMEInfo: 002.001, QW5kIHNvIGl0IGdvZXMgaW4gYT0gaW4gdGhlIEdTMiBoZWFkZXI_CgrCoAotYmlsbAoKCgotLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQpXaWxsaWFtIEouIE1pbGxzCiJQYXJhbm9pZCIgTVVYIFlhaG9vIQoKCgoKCk9uIE1vbmRheSwgTWFyY2ggMTAsIDIwMTQgMTA6NDkgQU0sIE5pY28gV2lsbGlhbXMgPG5pY29AY3J5cHRvbmVjdG9yLmNvbT4gd3JvdGU6CiAKT24gTW9uLCBNYXIgMTAsIDIwMTQgYXQgMTI6MjYgUE0sIENhbnRvciwgU2NvdHQgPGNhbnRvci4yQG9zdS5lZHU.IHdyb3RlOgo.IE8BMAEBAQE-
X-Mailer: YahooMailWebService/0.8.177.636
References: <CF3FAF4D.4B1F4%cantor.2@osu.edu> <1394230922.9009.YahooMailAndroidMobile@web142803.mail.bf1.yahoo.com> <CAPe4Cjp6KSL5FsHVzNPMxvE_E4BmaWgEuZQVr_wEkexH=ukpAg@mail.gmail.com> <CF436DAF.4B41B%cantor.2@osu.edu> <CAK3OfOivZAPDsanf-MAuUxFtzd5+vy51fpuw6UCgohmZP-T3MQ@mail.gmail.com>
Message-ID: <1394474177.99427.YahooMailNeo@web125601.mail.ne1.yahoo.com>
Date: Mon, 10 Mar 2014 10:56:17 -0700
From: Bill Mills <wmills@yahoo-inc.com>
To: Nico Williams <nico@cryptonector.com>, "Cantor, Scott" <cantor.2@osu.edu>
In-Reply-To: <CAK3OfOivZAPDsanf-MAuUxFtzd5+vy51fpuw6UCgohmZP-T3MQ@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="-1981468715-491122973-1394474177=:99427"
X-Milter-Version: master.31+4-gbc07cd5+
X-CLX-ID: 474180002
Archived-At: http://mailarchive.ietf.org/arch/msg/kitten/fxN_2jj5eCIwAHIbGZRr4suVpsM
Cc: "kitten@ietf.org" <kitten@ietf.org>
Subject: Re: [kitten] On SASL's authzid
X-BeenThere: kitten@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
Reply-To: Bill Mills <wmills@yahoo-inc.com>
List-Id: Common Authentication Technologies - Next Generation <kitten.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/kitten>, <mailto:kitten-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/kitten/>
List-Post: <mailto:kitten@ietf.org>
List-Help: <mailto:kitten-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/kitten>, <mailto:kitten-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 10 Mar 2014 17:57:00 -0000

And so it goes in a= in the GS2 header?

 
-bill



--------------------------------
William J. Mills
"Paranoid" MUX Yahoo!





On Monday, March 10, 2014 10:49 AM, Nico Williams <nico@cryptonector.com> wrote:
 
On Mon, Mar 10, 2014 at 12:26 PM, Cantor, Scott <cantor.2@osu.edu> wrote:
> On 3/10/14, 1:21 PM, "Ryan Troll" <rtroll@googlers.com> wrote:
>
>>Google uses the user= field as an authzid.  It identifies the mailbox
>>being accessed, and the session terminates at the server responsible for
>>that mailbox.
>>In the future, if a client provided users with the ability to log in as
>>user A and read mailbox B, we would want to know identity B.  Which
>>certainly appears to be the authzid.
>>Scott - does this help?
>
> It helps me, in the sense that both those use cases seem pretty clearly
> exactly what authzid is. They have literally nothing to do with OAuth or
> this mechanism, and would apply to any mechanism Google supported.

Agreed.  I think it's settled: user= is an authzid.

Nico

--

_______________________________________________
Kitten mailing list
Kitten@ietf.org
https://www.ietf.org/mailman/listinfo/kitten

v2.46.0 | Report a Bug | By Email | System Status