Subject: [lemonade] proposed text to resolve IESG discuss comments

From: Chris Newman <[email-masked]>
Date: Mon, 07 Nov 2005 17:19:05 -0800

Here is my proposed update to the text at the end of section 3.3 of BURL to 
address Sam's IESG review comments and Mark's related comments on this mailing 
list.

----
   When the submit server connects to the IMAP server, it is acting as
   an IMAP client and thus is subject to the mandatory-to-implement IMAP
   capabilities in section 6.1.1 of RFC 3501 as well as the security
   considerations in section 11 of RFC 3501.  Specifically, this means
   that the submit server needs to implement a configuration where it
   uses STARTTLS followed by SASL PLAIN [I-D.ietf-sasl-plain] to
   authenticate to the IMAP server in order to comply with the IMAP base
   specification.

   When the submit server is resolving a URLAUTH IMAP URL, it will use
   submit credentials when authenticating to the IMAP server.  The
   authentication id and password used for submit credentials MUST be
   configurable.  The string "submit" is suggested as a default value
   for the authentication id with no default for the password.  The SASL
   authorization id is typically empty so the IMAP server will derive
   the authorization id from the authentication id.

   When resolving a regular IMAP URL and both the submit client and
   submit server's embedded IMAP client are using STARTTLS with SASL
   PLAIN (or the equivalent), the submit server SHOULD cache and replay
   the client's credentials if and only if the submit server knows the
   IMAP server is in the same administrative domain.  If the submit
   server supports other SASL mechanisms, it MUST implement a
   configuration where the submit server's embedded IMAP client uses
   STARTTLS and SASL PLAIN with the submit server's authentication id
   and password (for the respective IMAP server) and the submit client's
   authorization id.
----

Is this acceptable, Sam?  Mark?

As soon as I get confirmation, I'll send in the -04 draft revision.

                - Chris

_______________________________________________
lemonade mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/lemonade

---

From: Sam Hartman <[email-masked]>
Date: Mon, 07 Nov 2005 21:54:42 -0500

This new text is excellent.

Thanks so much.