Proxy authentication (was WG Last Call: draft-ietf-sasl-rfc2222bis-02.txt)

[Alexey Melnikov <[e-mail]>]

[Because there are too many issues raised I will be starting a separate 
thread for each]

Kurt D. Zeilenga wrote:

>>  During the authentication protocol exchange, the mechanism performs
>>  authentication, transmits an authorization identity (frequently known
>>  as a userid) from the client to server, and negotiates the use of a
>>  mechanism-specific security layer.  If the use of a security layer is
>>  agreed upon, then the mechanism must also define or negotiate the
>>  maximum security layer buffer size that each side is able to receive.
>>
>>4.2.  Authorization identities and proxy authentication    
>>
>
>
>See note below regarding the term "proxy authentication".
>
>  
>
...

>>  The identity derived from the client's authentication credentials is
>>  known as the "authentication identity".  With any mechanism,
>>  transmitting an authorization identity of the empty string directs
>>  the server to derive an authorization identity from the client's
>>  authentication identity.
>>
>>  If the authorization identity transmitted during the authentication
>>  protocol exchange is not the empty string, this is typically referred
>>  to as "proxy authentication".
>>    
>>
>
>Personally, I refer to this as "proxy authorization".  Proxy
>authentication makes it sound like the feature can be used by a
>proxy to authenticate its users.
>
>  
>
Jeffrey Hutzelman wrote:

>>>   If the authorization identity transmitted during the authentication
>>>   protocol exchange is not the empty string, this is typically referred
>>>   to as "proxy authentication".
>>
>> Personally, I refer to this as "proxy authorization".  Proxy
>> authentication makes it sound like the feature can be used by a
>> proxy to authenticate its users.
>
> The same argument can be made for "proxy authorization".  We are 
> talking about "authentication by proxy", not "authentication to a 
> proxy".  And yes, we're really talking about authorization, not 
> authentication, but it's not really "authorization by proxy"; it's 
> just authorization.
>
> The terminology is pretty bad.  It's not clear to me that we need a 
> name for this at all.  But I'm pretty sure the phrase "proxy 
> authentication" has been in use for a while, and to change it might 
> cause more confusion than leaving it alone.


So, I will leave it as is.

Alexey