Re: [sasl] SCRAM as GSS-API mechanism

[Nicolas Williams <[e-mail]>]

On Thu, Jul 15, 2010 at 11:55:29AM -0400, Jeffrey Hutzelman wrote:
> >>   The application-data field MUST be set to the gs2-header, excluding
> >>   the initial [gs2-nonstd-flag ","] part, concatenated with, when a
> >>   gs2-cb-flag of "p" is used, the application's channel binding data.
> >
> >No, absolutely not.  See above.  The gs2-header MUST NOT be present in
> >the SCRAM-as-pure-GSS-API case.
> 
> In fact, when you use SCRAM-as-a-GSS-API-mechanism under GS2, GS2
> adds that header back in, producing something that is
> wire-compatible with SCRAM-as-SASL-mechanism, which was the whole
> point.

Right, I clarified my MUST NOT minutes later.  We must not require
GSS-API apps to prefix channel bindings data with the gs2-header -- the
only GSS-API that is allowed and required to do that is GS2.

If we started special casing channel bindings handling on a per-
mechanism basis, for anything other than the old "binding to network
addresses" thing, then we'd be making the GSS-API no longer a generic
API.

Nico
--