[Secdispatch] I-D on dealing with the 3xx XOR 401 problem

Nico Williams <nico@cryptonector.com> Sun, 29 March 2020 04:38 UTC

Return-Path: <nico@cryptonector.com>
X-Original-To: secdispatch@ietfa.amsl.com
Delivered-To: secdispatch@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CE5B33A10E8 for <secdispatch@ietfa.amsl.com>; Sat, 28 Mar 2020 21:38:01 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.199
X-Spam-Level:
X-Spam-Status: No, score=-0.199 tagged_above=-999 required=5 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cryptonector.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JGoGyiuZX1NO for <secdispatch@ietfa.amsl.com>; Sat, 28 Mar 2020 21:38:00 -0700 (PDT)
Received: from camel.ash.relay.mailchannels.net (camel.ash.relay.mailchannels.net [23.83.222.29]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5EA623A10E7 for <secdispatch@ietf.org>; Sat, 28 Mar 2020 21:37:58 -0700 (PDT)
X-Sender-Id: dreamhost|x-authsender|nico@cryptonector.com
Received: from relay.mailchannels.net (localhost [127.0.0.1]) by relay.mailchannels.net (Postfix) with ESMTP id 362AF36119C; Sun, 29 Mar 2020 04:37:54 +0000 (UTC)
Received: from pdx1-sub0-mail-a87.g.dreamhost.com (100-96-54-82.trex.outbound.svc.cluster.local [100.96.54.82]) (Authenticated sender: dreamhost) by relay.mailchannels.net (Postfix) with ESMTPA id 8F513361171; Sun, 29 Mar 2020 04:37:53 +0000 (UTC)
X-Sender-Id: dreamhost|x-authsender|nico@cryptonector.com
Received: from pdx1-sub0-mail-a87.g.dreamhost.com (pop.dreamhost.com [64.90.62.162]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384) by 0.0.0.0:2500 (trex/5.18.6); Sun, 29 Mar 2020 04:37:54 +0000
X-MC-Relay: Junk
X-MailChannels-SenderId: dreamhost|x-authsender|nico@cryptonector.com
X-MailChannels-Auth-Id: dreamhost
X-Desert-Continue: 44931d3454b4afa2_1585456674023_3467246815
X-MC-Loop-Signature: 1585456674023:3677758109
X-MC-Ingress-Time: 1585456674023
Received: from pdx1-sub0-mail-a87.g.dreamhost.com (localhost [127.0.0.1]) by pdx1-sub0-mail-a87.g.dreamhost.com (Postfix) with ESMTP id 1F5B0B2960; Sat, 28 Mar 2020 21:37:53 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=cryptonector.com; h=date :from:to:cc:subject:message-id:reply-to:mime-version :content-type; s=cryptonector.com; bh=K8wVIQrN3vF5cTda8rVokpLo9J Q=; b=OkMfHBmlmT/p6RlflH1c6os7NeuT9VRI11HHev81E8nZ5tjzDUrma1YAel lciSZ+INkwClyDtr+DCPlXKDUf0cP8Fe87StGcrs4e4q4piYavVwN6BRcmPYviTJ 4BN0KWJsDW6S4p4lcBPw63kknN3wvNlJRSKa+hgjGIC4zRrFg=
Received: from localhost (unknown [24.28.108.183]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) (Authenticated sender: nico@cryptonector.com) by pdx1-sub0-mail-a87.g.dreamhost.com (Postfix) with ESMTPSA id 84E1EB295B; Sat, 28 Mar 2020 21:37:50 -0700 (PDT)
Date: Sat, 28 Mar 2020 23:37:48 -0500
X-DH-BACKEND: pdx1-sub0-mail-a87
From: Nico Williams <nico@cryptonector.com>
To: ietf-http-wg@w3.org
Cc: secdispatch@ietf.org
Message-ID: <20200329043333.GO18021@localhost>
Reply-To: ietf-http-wg@w3.org
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.9.4 (2018-02-28)
X-VR-OUT-STATUS: OK
X-VR-OUT-SCORE: 0
X-VR-OUT-SPAMCAUSE: gggruggvucftvghtrhhoucdtuddrgedugedrudeivddgjeegucetufdoteggodetrfdotffvucfrrhhofhhilhgvmecuggftfghnshhusghstghrihgsvgdpffftgfetoffjqffuvfenuceurghilhhouhhtmecufedttdenucenucfjughrpeffhffvuffkrhggtggufgesthdtredttdervdenucfhrhhomheppfhitghoucghihhllhhirghmshcuoehnihgtohestghrhihpthhonhgvtghtohhrrdgtohhmqeenucffohhmrghinhepshgvvggrlhhsohdvrdhfvggvuggsrggtkhdpihgvthhfrdhorhhgpdhmihgtrhhoshhofhhtrdgtohhmnecukfhppedvgedrvdekrddutdekrddukeefnecuvehluhhsthgvrhfuihiivgeptdenucfrrghrrghmpehmohguvgepshhmthhppdhhvghloheplhhotggrlhhhohhsthdpihhnvghtpedvgedrvdekrddutdekrddukeefpdhrvghtuhhrnhdqphgrthhhpefpihgtohcuhghilhhlihgrmhhsuceonhhitghosegtrhihphhtohhnvggtthhorhdrtghomheqpdhmrghilhhfrhhomhepnhhitghosegtrhihphhtohhnvggtthhorhdrtghomhdpnhhrtghpthhtohepnhhitghosegtrhihphhtohhnvggtthhorhdrtghomh
Archived-At: <https://mailarchive.ietf.org/arch/msg/secdispatch/J5ZhbCl8qyO96HU75x6bT8RIv3c>
Subject: [Secdispatch] I-D on dealing with the 3xx XOR 401 problem
X-BeenThere: secdispatch@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Security Dispatch <secdispatch.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/secdispatch>, <mailto:secdispatch-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/secdispatch/>
List-Post: <mailto:secdispatch@ietf.org>
List-Help: <mailto:secdispatch-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/secdispatch>, <mailto:secdispatch-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 29 Mar 2020 04:38:02 -0000

I've just submitted draft-williams-http-accept-auth-and-redirect-00 [0]
to deal with the problem of the mutual exclusivity of 3xx and 401.

This problem arises when, for example, one mixes in some organization,
both Negotiate [RFC4559] and redirect-based authentication flows.  This
problem is rather vexing: the server has to decide which to go with
without knowing which the user-agent supports!

The solution seems simple: let the user-agent tell the server what
authentication schemes it supports.  (Indeed, one common hack is to
glean this from the user-agent string.)  As well, let the server mix
redirection and authentication requests.

As well, while we're at it, why not codify redirect-based
authentication.  In particular, the PowerShell HTTP command-line client,
Invoke-WebRequest [1] has an option to copy Authorization headers from
redirect responses to redirected requests, which seems like just the
ticket:

|   -PreserveAuthorizationOnRedirect
|
|   Indicates the cmdlet should preserve the Authorization header, when
|   present, across redirections.
|
|   By default, the cmdlet strips the Authorization header before
|   redirecting. Specifying this parameter disables this logic for cases
|   where the header needs to be sent to the redirection location.

ISTR seeing a prohibition on copying headers from redirect responses to
redirected requests, but I can't find this now.  Digest [RFC2617]
actually describes the Authorization-copying behavior in a paragraph
that straddles pages 17 and 18, using the "domain" parameter of Digest
to effect a redirection.

This I-D then adds an Accept-Auth request header, and an HTTP
authentication scheme named Redirect, and codifies other ways to mix
redirection and authentication requests.

This I-D seems trivial enough to go the ISE route, but perhaps some WG,
such as HTTPbis, might be interested in taking a closer look, reviewing,
possibly leading to request not to publish (if, e.g., there's already a
solution I've missed or this is problematic for some reason), or to
adopting the work.

Cc'ed is secdispatch@ietf.org, in case they want to dispatch this I-D.
Reply-To is set to HTTPbis.

See also [2].

Feedback would be greatly appreciated.  Stay safe!

[0] https://tools.ietf.org/html/draft-williams-http-accept-auth-and-redirect-00
    https://www.ietf.org/internet-drafts/draft-williams-http-accept-auth-and-redirect-00.txt

[1] https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/invoke-webrequest?view=powershell-7

[2] https://mailarchive.ietf.org/arch/msg/art/T4nP5Rv91yuE0ew8p0vJh2fX1IM/

Nico
--