Re: [kitten] sasl-oauth "user" as a kvpair or in the gs2 header?

[Bill Mills <[e-mail]>]

It is not used as a SASL identity.  Quoting from -03 and -14 in progress:

"user (REQUIRED):

Contains the user name being 
authenticated.  The server MAY use this as a routing or database lookup 
hint.  The server MUST NOT use this as authoritative, the user name MUST be asserted by the OAuth credential."
 
Also, looking at the Google API docs for XOAUTH2, they implemented based on the -03 spec and have the "user=$username" syntax.  See https://developers.google.com/gmail/xoauth2_protocol 

Based on Google's server API and the extant clients they have I'd like to ask for a consensus call on the following:

1) Add the -03 "user" kvpair back into the spec.

a) YES or b) NO.  

2) Should we include a GS2 header"

a) No, let's wait for the GS2 update that deals with things that lack mutual auth and then write a spec that defines a GS2 header for SASL+OAUTH.

b) Change the definition of "key" in kvpair to 1*(ALPHA / ",").  This makes a GS2 header followed by a ^A (i.e. "n,a=[e-mail]^A") a valid kvpair which would be ignored by servers that don't understand it. 

c) Define a stub OPTIONAL GS2 header explicitly.

d) Include a fully
 defined GS2 header (language from draft -10).


My own feedback is 1: YES, 2: a or b.


-bill



--------------------------------
William J. Mills
"Paranoid" MUX Yahoo!





On Tuesday, March 4, 2014 12:06 AM, Sam Hartman <[e-mail]> wrote:
 
t's discuss Thursday.
I'd like to understand what the user= value signifies and whether it's
actually a SASL authorization identifier.

I'd like to understand whether there's value in an unprotected SASL
authorization identifier.