Re: [kitten] sasl-oauth "user" as a kvpair or in the gs2 header?

Apologies for the delay in responding.

I understand this was discussed in today's meeting; and we're going to have
a follow-up to discuss further - very reasonable.

To answer Bill's original question: user= or a= --> Either works for us.
 If one has better implications than the other, we'll use it.

-R

On Tue, Mar 4, 2014 at 7:55 AM, Bill Mills <wmills@yahoo-inc.com> wrote:

>
> It is not used as a SASL identity.  Quoting from -03 and -14 in progress:
> "user (REQUIRED):
> Contains the user name being authenticated. The server MAY use this as a
> routing or database lookup hint. The server MUST NOT use this as
> authoritative, the user name MUST be asserted by the OAuth credential."
>
> Also, looking at the Google API docs for XOAUTH2, they implemented based
> on the -03 spec and have the "user=$username" syntax.  See
> https://developers.google.com/gmail/xoauth2_protocol
>
> Based on Google's server API and the extant clients they have I'd like to
> ask for a consensus call on the following:
>
> 1) Add the -03 "user" kvpair back into the spec.
>
> a) YES or b) NO.
>
> 2) Should we include a GS2 header"
>
> a) No, let's wait for the GS2 update that deals with things that lack
> mutual auth and then write a spec that defines a GS2 header for SASL+OAUTH.
>
> b) Change the definition of "key" in kvpair to 1*(ALPHA / ",").  This
> makes a GS2 header followed by a ^A (i.e. "n,a=user@example.com^A") a
> valid kvpair which would be ignored by servers that don't understand it.
>
> c) Define a stub OPTIONAL GS2 header explicitly.
>
> d) Include a fully defined GS2 header (language from draft -10).
>
>
> My own feedback is 1: YES, 2: a or b.
>
> -bill
>
>
> --------------------------------
> William J. Mills
> "Paranoid" MUX Yahoo!
>
>
>
>   On Tuesday, March 4, 2014 12:06 AM, Sam Hartman <hartmans-ietf@mit.edu>
> wrote:
>  t's discuss Thursday.
> I'd like to understand what the user= value signifies and whether it's
> actually a SASL authorization identifier.
>
> I'd like to understand whether there's value in an unprotected SASL
> authorization identifier.
>
>
>
>
>
>
> _______________________________________________
> Kitten mailing list
> Kitten@ietf.org
> https://www.ietf.org/mailman/listinfo/kitten
>
>