Re: WG Last Call: draft-ietf-sasl-rfc2222bis-02.txt

[Alexey Melnikov <[e-mail]>]

Kurt D. Zeilenga wrote:

>>7.    The EXTERNAL mechanism
>>
>>  The mechanism name associated with external authentication is
>>  "EXTERNAL".
>>
>>  The client sends an initial response with the UTF-8 encoding of the
>>  authorization identity. The form of the authorization identity is
>>  further restricted by the application-level protocol's SASL profile.
>>
>>  The server uses information, external to SASL, to determine whether
>>  the client is authorized to authenticate as the authorization
>>  identity.
>>    
>>
>
>It may be appropriate to note that the client can make no
>assumptions as what information the server uses in determining
>client authorization.  E.g., just because TLS was established,
>doesn't mean the server will use TLS-provided information.
>  
>
Done. The new text reads:

The system providing this external information may be, for example,
IPSec or TLS. However, the client can make no assumptions as to what
information the server can use in determining client authorization.
E.g., just because TLS was established, doesn't mean that the server
will use the information provided by TLS.

>>7.2.  Example
>>
>>  The following is an example of an EXTERNAL authentication in the SMTP
>>  protocol [SMTP-AUTH].
>>    
>>
>
>Replace [SMTP-AUTH] with an informative reference to the SMTP base
>specification.  Insert [SMTP-AUTH] after the word "profile" below.
>
Done.

Alexey