Re: [precis] usernames in PRECIS and http-auth

Dear Peter,

I feel that I'm bit confusing about the situation and possible mistake.

As presented in a precis WG long before, and as talked with you with Julien,
my intended set for username in HTTP is almost "every printable string", so
"@yoiwa", "@@@@@", "Yutaka Oiwa",
"Y      O" must be all allowed, and
my understanding is that saslprepbis does not allow most of these.
In other words, http's name must be superset of sasl, and is never be a
proper subset of that.
Did I made some mistake on specification or interpretation of saslprepbis?

-- 
Yutaka OIWA <y.oiwa@aist.go.jp> on mobile
2014/03/08 23:49 "Peter Saint-Andre" <stpeter@stpeter.im>:

> As promised at IETF 89, I have compared the username definitions from
> draft-oiwa-precis-httpauthprep-00 and draft-ietf-precis-saslprepbis-06,
> with the purpose of perhaps harmonizing the two approaches so that we can
> avoid multiplying PRECIS profiles beyond necessity.
>
> (I am writing this email on the flight home, and I neglected to load up
> the meeting minutes before leaving, so I might not address all of the
> relevant points in this message.)
>
> First, let's look at the syntax definitions.
>
> draft-ietf-precis-saslprepbis-06 states that a username can (a) consist
> of one of more userparts, or (b) can be of the form userpart@domainpart.The ABNF definition is:
>
>    username   = userpart [1*(1*SP userpart)]
>               / userpart '@' domainpart
>
>    userpart   = 1*(idpoint)
>
>    domainpart = IP-literal / IPv4address / ifqdn
>
>    ifqdn      = 1*1023(domainpoint)
>
> Where:
>
> * an "idpoint" is a UTF-8 encoded Unicode code point that conforms to the
> PRECIS "IdentifierClass"
> * an "IPv4address" is as defined in RFC 3986
> * an "IP-literal" is as defined in RFC 3986
> * a "domainpoint" is a UTF-8 encoded Unicode code point that conforms to
> RFC 5890
>
> By contrast, draft-oiwa-precis-httpauthprep states that a username
> consists of one or more UTF-8 encoded Unicode code points that conform to
> the PRECIS "IdentifierClass". The ABNF definition is:
>
>    userpart   = 1*(idpoint)
>
> We quickly see that an http-auth username is a legal PRECIS username,
> since 1*(idpoint) is simply a userpart as defined in
> draft-ietf-precis-saslprepbis-06, and a PRECIS username can consist of
> only one userpart. Therefore, in this respect, I think the httpauthprep
> text (whether it appears in a standalone document or elsewhere) can simply
> state that for purposes of HTTP authentication a username is a userpart as
> defined in draft-ietf-precis-saslprepbis.
>
> Second, let's look at the string preparation method.
>
> Here, too, draft-oiwa-precis-httpauthprep-00 is a subset of
> draft-ietf-precis-saslprepbis-06. The preparation method in
> draft-ietf-precis-saslprepbis-06 is:
>
>    1.  The base string class is the "IdentifierClass" specified in
>        [I-D.ietf-precis-framework].
>    2.  Fullwidth and halfwidth characters MUST be mapped to their
>        decomposition equivalents.
>    3.  So-called additional mappings MAY be applied, such as those
>        defined in [I-D.ietf-precis-mappings].
>    4.  Uppercase and titlecase characters might be mapped to their
>        lowercase equivalents (see Section 4.2.1 below).
>    5.  Unicode Normalization Form C (NFC) MUST be applied to all
>        characters.
>
> By contrast, the preparation method in draft-oiwa-precis-httpauthprep-00
> is:
>
>    1.  Fullwidth and halfwidth characters MUST be mapped to their
>        decomposition equivalents.
>    2.  Additional mappings SHOULD NOT be applied, such as those defined
>        in [I-D.ietf-precis-mappings], unless there are implementation-
>        dependent reasons to do so, or these are exceptionally required
>        by specific authentication schemes.
>    3.  Case mapping is not applied.
>    4.  Unicode Normalization Form C (NFC) MUST be applied to all
>        characters.o
>
> These two defnitions agree on the width mapping and normalization rules
> described in the PRECIS framework. They appear to differ slightly with
> regard to the additional mapping and case mapping rules. However,
> draft-oiwa-precis-httpauthprep-00 is merely a bit more restrictive with
> regard to matters that are purely optional according to
> draft-ietf-precis-saslprepbis-06. For example, the option of saying that
> "case mapping is not applied" is allowed by the text "uppercase and
> titlecase characters might be mapped to their lowercase equivalents".
>
> To make this clearer, I suggest that we modify the advice in
> draft-oiwa-precis-httpauthprep-00 so that it no longer defines its own
> PRECIS profile. Instead, I suggest that we phrase the httpauthprep text in
> terms of the username profile in draft-ietf-precis-saslprepbis-06. To my
> mind, something like this would work:
>
> ###
>
> For the purposes of HTTP authentication, a username conforms to the syntax
> definition and preparation methods specified in [I.D-draft-ietf-precis-saslprepbis],
> with the following limitations:
>
> * a username conforms to the "userpart" construction from
> [I-D.draft-ietf-precis-saslprepbis]
> * case mapping is not applied
> * delimiter mappings, special mappings, and other so-called additional
> mappings [I-D.draft-ietf-precis-mappings] are not applied
>
> ###
>
> As far as I can see, this simplifies the httpautheprep text quite a bit.
>
> (By the way, draft-oiwa-precis-httpauthprep-00 also seems to copy the
> password profile verbatim from draft-ietf-precis-saslprepbis. I think this
> text can be removed entirely, so that the httpauthprep text can simply
> reference draft-ietf-precis-saslprepbis.)
>
> Yutaka and Alexey (and others), let me know what you think about what I
> have written here.
>
> Thanks,
>
> Peter
>
> _______________________________________________
> precis mailing list
> precis@ietf.org
> https://www.ietf.org/mailman/listinfo/precis
>