Subject: Re: [lemonade] I-D ACTION:draft-ietf-lemonade-urlauth-08.txt

From: Mark Crispin <[email-masked]>
Date: Tue, 29 Nov 2005 16:36:42 -0800 (Pacific Standard Time)

Sorry that I didn't answer this earlier:

On Fri, 14 Oct 2005, Alexey Melnikov wrote:
>>     In [IMAPURL], a URL of the form imap://[email-masked]/INBOX/;uid=20
>>     requires authorization as userid "fred".  However, [IMAPURL] implies
>>     that it only supports authentication,
> Actually, this is not true. IMAP URL uses the term "userid", which is 
> synonymous to authorization identity in SASL.
> There is no way to specify authentication identity, because IMAP URLs are not 
> allowed to contain passwords.

The full text (which you had split) is:

    In [IMAPURL], a URL of the form imap://[email-masked]/INBOX/;uid=20
    requires authorization as userid "fred".  However, [IMAPURL] implies
    that it only supports authentication, and confuses the concepts of
    authentication and authorization.

(I added the word "of" in the third line in my post-08 fixes).  I think 
that the part about "confusion" is important to understand the entire 
thing.

We all agree that "fred" is an authorization identify.

However, in reading [IMAPURL] (RFC 2192), we find extensive discussion of 
authentication in chapter 3 (including the ";AUTH=..." syntax), and no 
mention at all of authorization.

That's the intended meaning of this text; the userid here is 
authorization, but [IMAPURL] discusses it as if it was authentication. 
That's why URLAUTH has to fix it.

>>     The URLAUTH extension defines an authorization mechanism for IMAP
>>     URLs to replace [IMAPURL]'s authentication-only mechanism.
> Same as above.

The sentence would be better if it said "broken authentication-only 
mechanism".  But let's not go there.

>>  URLAUTH
>>     conveys authorization in the URL name itself, and reuses a portion of
> what is "URL name"?

Changed to "URL string" in post-08 fixes.

>>     the syntax of the [IMAPURL] authentication mechanism to convey the
>>     authorization identity (which also defines the default namespace in
>>     [IMAP]).
> This is still confusing (at least for me). I think what you are trying to say 
> that in the following IMAP URL:
> <imap://[email-masked]/INBOX/;uid=20;URLAUTH=user+dave:...>
> "dave" is used for authorization and "fred" is used to define mailbox scope.

Actually, I'm trying to say:

[IMAPURL] only has authentication (because it doesn't talk about 
authorization at all), and it's broken since in
 	imap://[email-masked]/INBOX/;uid=20
"fred" is really authorization and default namespace.

To fix this broken situation, URLAUTH redefines "fred" as being 
authorization and default namespace, thus corresponding with reality.

rfc2192bis should do the same (work item for you).

> 2). draft-ietf-lemonade-rfc2192bis-00.txt have renamed some of IMAP URL 
> non-terminals to be more aligned with the generic URI syntax. Oh well, we 
> don't have to worry about URLAUTH until draft-ietf-lemonade-rfc2192bis-XX.txt 
> is published as an RFC.

I don't understand this.  Shouldn't URLAUTH be published first?

Maybe rfc2192bis should incorporate URLAUTH.  Is lemonade the right WG for 
it?  Perhaps it should be passed to imapext, or just made a private 
effort?

> 3). ABNF reference must be updated to RFC 4234.

Done in post-08 fixes.

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.
Si vis pacem, para bellum.

_______________________________________________
lemonade mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/lemonade

---

From: Alexey Melnikov <[email-masked]>
Date: Wed, 30 Nov 2005 15:45:55 +0000

Mark Crispin wrote:

>> 2). draft-ietf-lemonade-rfc2192bis-00.txt have renamed some of IMAP 
>> URL non-terminals to be more aligned with the generic URI syntax. Oh 
>> well, we don't have to worry about URLAUTH until 
>> draft-ietf-lemonade-rfc2192bis-XX.txt is published as an RFC.
>

Yes, unfortunately.

> Maybe rfc2192bis should incorporate URLAUTH.

Yes (the URL part of it).

> Is lemonade the right WG for it?

rfc2192bis is already a Lemonade WG draft.

> Perhaps it should be passed to imapext, or just made a private effort?
>

---

From: Alexey Melnikov <[email-masked]>
Date: Wed, 30 Nov 2005 16:00:36 +0000

Mark Crispin wrote:

>> There is no way to specify authentication identity, because IMAP URLs 
>> are not allowed to contain passwords.
>
> (I added the word "of" in the third line in my post-08 fixes).  I 
> think that the part about "confusion" is important to understand the 
> entire thing.

I guess I prefer "not clear on the concepts of ..." instead of "confuses 
the concepts of".

> However, in reading [IMAPURL] (RFC 2192), we find extensive discussion 
> of authentication in chapter 3 (including the ";AUTH=..." syntax), and 
> no mention at all of authorization.

Ok. When I saw the word "authentication" in RFC 2192 I've implicitly 
assumed "SASL authentication" which includes authorization identity...

> mechanism".  But let's not go there.

I would prefer if you rephrase the sentence, something like:
    The URLAUTH extension defines an authorization mechanism for IMAP
    URLs to replace [IMAPURL]'s authentication mechanisms that don't 
support authorization.

>> This is still confusing (at least for me). I think what you are 
>> trying to say that in the following IMAP URL:

Ok, but I don't think this is what the sentence says. After rereading 
the original sentence:

     URLAUTH

I don't understand if authorization information is conveyed as a part of 
"authentication mechanism" or "in the URL string itself" (i.e. after 
";URLAUTH=").
In my example:
 <imap://[email-masked]/INBOX/;uid=20;URLAUTH=user+dave:...>

the former is "fred" and the latter is "dave".

> rfc2192bis should do the same (work item for you).

Point taken.