Subject: No response versa an empty response in the last leg of a SASL exchange

From: Alexey Melnikov <[email-masked]>
Date: Fri, 12 Mar 2004 14:47:03 +0000

I am forwarding this message from the LDAPbis mailing list as suggested 
by Kurt.
Does this message have enough context to start a discussion of the issue?

-------- Original Message --------
Subject: 	Re: SASL mechanisms that return no data in last leg
Date: 	Thu, 11 Mar 2004 19:26:50 -0800
From: 	Kurt D. Zeilenga <[email-masked]>
To: 	Alexey Melnikov <[email-masked]>
CC: 	[email-masked], [email-masked]
References: 	<[email-masked]> 
<[email-masked]> <[email-masked]> 
<[email-masked]>

At 07:14 PM 3/9/2004, Alexey Melnikov wrote:
>Kurt D. Zeilenga wrote:
>
>>I'd have to agree with Alexey.  The mechanism for provide data
>>with the last leg of the exchange is optional.  That is, if there
>>is data to be sent AND the server chooses not to require
>>another roundtrip, the server can attach the data to last
>>message.
>>
>>Another point is that SASL allows the mechanism data
>>in any message of the exchange to be any octet string,
>>including a zero length string.  Hence, it seems that
>>no string and a zero length string are not necessarily
>>semantically equivalent here.
>This is correct, however LDAP is the first SASL profile I've seen that is able to represent them differently.
>Do you think that we should say something about this in the base SASL document?

I suggest we take this one to the SASL WG list.  I suspect they
will have to say something about this, such as they had to do
for zero-length v. absent authorization identity strings.  Once
they reach consensus as to what to say, we'll adapt as needed.

I suspect they will have to be declared equivalent and a
recommendation made that applications support one or the
other but not both.

Kurt