Re: [kitten] On SASL's authzid

Google uses the user= field as an authzid.  It identifies the mailbox being
accessed, and the session terminates at the server responsible for that
mailbox.

In the future, if a client provided users with the ability to log in as
user A and read mailbox B, we would want to know identity B.  Which
certainly appears to be the authzid.

Scott - does this help?

-R
On Mar 7, 2014 2:22 PM, "Bill Mills" <wmills_92105@yahoo.com> wrote:

> Then user isn't autzid it's authcid.
>
> Sent from Yahoo Mail on Android<http://overview.mail.yahoo.com/mobile/?.src=Android>
>
>  ------------------------------
> * From: * Cantor, Scott <cantor.2@osu.edu>;
> * To: * Bill Mills <wmills_92105@yahoo.com>; Nico Williams <
> nico@cryptonector.com>; Nordgren, Bryce L -FS <bnordgren@fs.fed.us>;
> * Cc: * kitten@ietf.org <kitten@ietf.org>;
> * Subject: * Re: [kitten] On SASL's authzid
> * Sent: * Fri, Mar 7, 2014 10:19:10 PM
>
>   On 3/7/14, 5:13 PM, "Bill Mills" <wmills_92105@yahoo.com> wrote:
>
> >So can we say that the value in "user" must agree with the user asserted
> >by the token?
>
> That depends on what "agree" means. It's a policy issue.
>
> The athzid is the *asserted* identity to login as, which is NOT always
> what's in the token. The token is who's logging in, the authzid is who
> you're logging in *as* for that transaction.
>
> If by agree you mean "is authorized to act as", then yes. But that's
> entirely application layer business, nothing to do with the mechanism.
>
>
> -- Scott
>
>
> _______________________________________________
> Kitten mailing list
> Kitten@ietf.org
> https://www.ietf.org/mailman/listinfo/kitten
>
>