Re: [kitten] Alexey's comments Re: WGLC of draft-ietf-kitten-sasl-oauth-18

[Bill Mills <[e-mail]>]

I didn't before.
http://htmlpreview.github.io/?https://github.com/sweetums/idrafts/blob/master/draft-ietf-kitten-sasl-oauth-19.html
 

     On Wednesday, January 7, 2015 5:59 PM, Benjamin Kaduk <[e-mail]> wrote:
   

 Seems reasonable here; let's see what it looks like in the next revision.
(Do you keep your working copy somewhere public?  I have forgotten.)

Thanks,

Ben

On Wed, 7 Jan 2015, Bill Mills wrote:

> Added 
> "The client response consisting of only a single kvsep is used only when authentication fails, and is only valid in that context. If sent as the first message from the client the server MAY simply fail the authentication without returning discovery information since there is no user or server name indication."
>
>
>      On Wednesday, January 7, 2015 9:57 AM, Benjamin Kaduk <[e-mail]> wrote:
>
>
>  Bill, Alexey,
>
> Thanks for working through these comments (I'm still catching up after the
> holidays) -- I do agree with Alexey that having the examples right is very
> important.
>
> Looking through this thread, I don't see a response to one of Alexey's
> comments, though:
>
> % client_resp    = (gs2-header kvsep 0*kvpair kvsep) / kvsep
> %
> % Did you mean that the whole client response can be just a single separator
> % character? I think this is not compatible with GS2 framing. If you only meant to
> % allow that for failed authentication, I suggest you add a comment and point to
> % section 3.2.3.
>
> If I correctly remember how things work, I think that Alexey is right that
> this is only allowed for failed authentication, so a comment is needed
> here.
>
> -Ben
>
>
>
>
>