Re: [secdir] review of draft-ietf-kitten-sasl-openid-06

[Jeffrey Hutzelman <[e-mail]>]

On Tue, 2011-11-01 at 11:43 -0400, Stephen Kent wrote:

> > The situation is a bit more complicated than a simple MUST/MAY, but
> > I
> > believe everything is clear from the base SASL specification:
> > https://tools.ietf.org/html/rfc4422#section-3.4.1
> > 
> > Authorization identities are always optional, but mechanisms are
> > required to be able to transfer them if they are used by the
> > application.
> 
> 
> That statement, if placed in the I-D, will resolve my question.


That statement is not within the scope of this I-D.  It's descriptive of
SASL itself, and is covered in the SASL base specification.  In
particular, the requirement is one placed on SASL mechanisms (such as
the present I-D) by SASL itself.

Implementation of this mechanism requires an understanding of the SASL
base specification (unless one is implementing only the underlying
GSS-API mechanism, in which case the section in question is not relevant
at all).  I don't think it's necessary for every SASL mechanism to
restate all of SASL's requirements, and it may even be harmful, because
then it looks like you're trying to say something _different_ than what
the SASL spec says.

Do you really think any SASL implementor is going to be confused by
this?