Re: [kitten] On SASL's authzid

[Nico Williams <[e-mail]>]

On Fri, Mar 7, 2014 at 8:41 AM, Alexey Melnikov
<[e-mail]> wrote:
> > Q: What is it?  It is:
>>
> > My answer, as I understand it the authzid is:
> >
> > - an advisory,
>
> This is not quite correct. Authentication engine needs to obey the specified
> value and can't just ignore it. Specific algorithm how an authenticated user
> is  authorised to act as an authzid is implementation and protocol specific.

The authorization check could be synthetic though.  The authzid value
is only transported by the mechanism.  The app decides if the authcid
is permitted, and this decision can be very synthetic: use the authzid
to find something, then decide if the user has access.  For example,
in LDAP the authzid might be a DN, but as you know the rules for
matching some object by DN are not trivial, so the user may not
provide a canonical DN and everything might still work.  Indeed, the
server is free to decide that the access the user would have had w/o
an authzid is the same with any authzid -- nothing in RFC4422 forces
it to never so decide.

But maybe this isin't important.  The question I just asked Chris is
more important: is it OK for new mechanisms to impose new UIs/user
interactions on existing applications?

Nico
--