Re: [kitten] The Hashed-Token SASL Mechanism (SASL-HT)

[Sam Whited <[e-mail]>]

On Tue, Oct 17, 2017, at 11:57, Alexey Melnikov wrote:
> Normalization to disallow problematic characters is a good thing, so I 
> think a SHOULD level requirement is appropriate. But I am not sure that 
> case-mapped version of UserName profile is the right thing here.

I agree, I just don't think this needs to be part of the authentication
framework. It should already be handled by the application level
protocol. Ex. RFC 7622 already defines how XMPP normalizes usernames, so
why should this mandate that we run that step again?

Also, what if a system wants to use UsernameCasePreserved but this
mechanism uses UsernameCaseMapped (or visa versa), the SASL mechanism
would be breaking that profile. Even if we change to username case
preserved (which I think is more correct than case mapped in this case,
FWIW) what if the application using this profile specifically allows
characters in usernames that aren't allowed by the identifier class of
PRECIS? We shouldn't be making that decision for people.

—Sam