Subject: Re: CAPABILITIES, again...

From: Doug Royer <[email-masked]>
Date: Mon, 2 Aug 1999 16:09:08 -0700 (PDT)

> From: [email-masked]
> Date: Mon, 02 Aug 1999 22:33:58 GMT
> 
> Steve:
>
> I think that I was one of the primary individuals objecting to having a 
> separate command. I don't have such reservations anymore. 
> Some one gave me the compelling argument FOR such an individual command by 
> pointing out that the only way to rediscover what your capabilities were 
> was to either change your identity or reauthenticate the connection. Seems 
> rather rough a requirement.
> So if folks agree, I don't see a reason why we shouldn't include a 
> separate CAPABILITIES command.

I don't have a problem with a separate CAPABILITIES command.

I thought the question Steve asked was; Should connect, authenticate
and identity commands return the results of a CAPABILITIES command?

1) The 1st thing a CUA MUST do after connecting is a CAPABILITIES command
   in order to determine which AUTH mechanism to use, correct?

2) For security reasons a CS may wish NOT to broadcast non-AUTH
   CAPABILITIES at connect time, or connect + CAPABILITIES time.  So a
   CUA MUST re-send the CAPABILITIES command after authentication.
   
3) Because one or more users may have additional permissions, these can
   not be determined any other way - other than issuing a CAPABILITIES
   command after a successful AUTH and IDENTITY commands.

For those reasons, I suggested:

	1) That AUTH only CAPABILITIES be sent as a result of
	   a connect. As 100% of the time a CUA MUST ask after
	   a connect. So why not send it as a result of connect?
	   
	2) Then after a successful AUTH has completed. A CUA
	   MUST then get the CAPABILITIES for that authenticated
	   user. So why not send it as a result of a successful
	   authentication?
	   
	3) If the user changes identity (Via the IDENTITY command).
	   Then a CUA MUST re-issues a CAPABILITIES command.
	   So why not send it as a result of a successful IDENTIFY?
	
-Doug

---

From: Alexander Taler <[email-masked]>
Date: Mon, 02 Aug 1999 19:36:49 -0400

>            So why not send it as a result of a successful IDENTIFY?

A CUA which is regularly polling a CS, but not maintaining a 
connection, will store authentication information and will 
not need the capabilities after every logon.

However, if we are not talking about a significant amount of 
data then sending it after AUTHENTICATE shouldn't be a problem.

How about we make it optional to return them after AUTHENTICATE
and provide a CAPABILITIES command?  Then administrators could
tailor the server to their needs.

Alex