Re: [secdir] review of draft-ietf-kitten-sasl-openid-06

[Stephen Kent <[e-mail]>]

At 1:01 PM -0400 11/2/11, Jeffrey Hutzelman wrote:
>On Tue, 2011-11-01 at 11:43 -0400, Stephen Kent wrote:
>
>>  > The situation is a bit more complicated than a simple MUST/MAY, but
>>  > I
>>  > believe everything is clear from the base SASL specification:
>>  > https://tools.ietf.org/html/rfc4422#section-3.4.1
>>  >
>>  > Authorization identities are always optional, but mechanisms are
>>  > required to be able to transfer them if they are used by the
>>  > application.
>>
>>
>>  That statement, if placed in the I-D, will resolve my question.
>
>
>That statement is not within the scope of this I-D.  It's descriptive of
>SASL itself, and is covered in the SASL base specification.  In
>particular, the requirement is one placed on SASL mechanisms (such as
>the present I-D) by SASL itself.
>
>Implementation of this mechanism requires an understanding of the SASL
>base specification (unless one is implementing only the underlying
>GSS-API mechanism, in which case the section in question is not relevant
>at all).  I don't think it's necessary for every SASL mechanism to
>restate all of SASL's requirements, and it may even be harmful, because
>then it looks like you're trying to say something _different_ than what
>the SASL spec says.
>
>Do you really think any SASL implementor is going to be confused by
>this?

Since I am not a SASL implementer, I can't say. I can say that as a 
reasonably intelligent reader, I found the wording ambiguous. I am 
opposed to ambiguous statement in RFCs :-).

Steve