Re: [kitten] Feedback from IETF #83 on the OAUTH/SASL-KRB draft

[William Mills <[e-mail]>]

Simon,

Easy extensibility for new auth profiles is the major/only reason for this.  We can achieve this another way as well, we'd have to define an extensible name/value pair mapping from HTTP data elements.  Somewhat simpler parsing, but adds a different layer of complexity.

-bill




>________________________________
> From: Simon Josefsson <[e-mail]>
>To: William Mills <[e-mail]> 
>Cc: "[e-mail]" <[e-mail]> 
>Sent: Wednesday, April 4, 2012 12:53 AM
>Subject: Re: Feedback from IETF #83 on the OAUTH/SASL-KRB draft
> 
>William Mills <[e-mail]> writes:
>
>> For the OAUTH mechanism a similar style signed request example is:
>> GET / HTTP/1.1
>> Host: server.example.com
>> User: [e-mail]
>> Authorization: MAC token="h480djs93hd8",timestamp="137131200",
>> nonce="dj83hs9s",signature="YTVjyNSujYs1WsDurFnvFi4JK6o="
>>
>>
>> The OAUTH mechanism will require (as currently specified) parsing of a
>> Host, User, and Authorization header.
>
>Why can't this be parsed before it is sent it over the SASL wire, and
>the necessary HTTP headers reconstructed on the other side?
>
>Is it because you want to offer compatibility with future OAuth
>extensions that would send additional HTTP headers?  So by sending HTTP
>headers over SASL, you will automatically support those future
>extensions as well?
>
>I can understand that reason.  Are there other reasons?
>
>/Simon
>
>
>