Re: [kitten] On SASL's authzid

[Nico Williams <[e-mail]>]

On Fri, Mar 7, 2014 at 6:52 AM, Chris Newman <[e-mail]> wrote:
> --On March 6, 2014 20:05:39 -0600 Nico Williams <[e-mail]>
> wrote:
> Two common scenarios for authorization identity are: using administrative
> credentials to login as another user, or a secretary using her credentials
> to login as her boss.

But there's a third one: name the IMAP mailbox you want to access.  In
the OAuth case, isn't that a "routing hint"?

>> Q: Why do we care about fitting things into the authzid?
>>
>> My answer: because we don't want mechanisms to force new _required_
>> input elements on existing SASL APIs.
>
> I do not consider this an important design consideration, although it may be
> desirable to improve deployability of a mechanism. SASL's important function
> is a protocol design abstraction -- allowing an authentication mechanism
> suitable for multiple protocols to be encapsulated in multiple protocols
> without having to write how to do it separately for each one. Using a SASL
> API is completely optional and I've seen several cases where I consider SASL
> API usage harmful.

Fair enough.  What about application UIs then?  If an IMAP application
uses SASL and has a field in a GUI for authzid, is it OK for it to
have to add a new field for a new mechanism?

Nico
--