Re: [secdir] review of draft-ietf-kitten-sasl-openid-06

[Jeffrey Hutzelman <[e-mail]>]

Simon Josefsson <[e-mail]> wrote:

>Perhaps the solution is to remove text rather than add more?
>
>I share Jeff's concern that adding text here may give the impression
>that it implies something different than what a SASL implementer would
>expect to follow automatically from the normative references.
>
>How about removing this sentence:
>
>       The GS2 header carries the optional authorization identity.
>
>from section 3.1 and modify the other paragraph in section 3.1 into
>
>   The syntax and semantics of the "gs2-header" is specified in
>   [RFC5801], and we use it here with the following limitations.  The
>   "gs2-nonstd-flag" MUST NOT be present.  The "gs2-cb- flag" MUST be
>   "n" because channel binding is not supported by this mechanism.
>
>The document is already clear elsewhere that the mechanism supports the
>concept of authorization identities (see beginning of section 3).
>
>The syntax and semantics of the authorization identity field is covered
>normatively by the base SASL specification and the GS2 document.

So, the reason not to do that is that we've decided (I think) that people doing pure-SASL implementations of dual-stack mechanisms such as this one should normally not have to read the GS2 spec, since it specifies a layer of abstraction that they don't care about.

OTOH, I think we can be clearer.  The new text you just proposed is a good start; we can refer to GS2 for clarification without annoying pure-SASL implementers too much.  But instead of removing references to "optional authorization identity", what if we change them to "SASL authorization identity, when used" ?  This makes it clear that an autzid might _not_ be used, provides a hint where to look to learn more about autzids (SASL), and avoids the impression that we are applying the word OPTIONAL to anything.

>/Simon