Subject: Re: Half-anonymous authentication [corrected]

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Sat, 10 Apr 2004 13:47:08 -0700

I need to slow down...

At 11:09 AM 4/10/2004, Sam Hartman wrote:
>>>>>> "Kurt" == Kurt D Zeilenga <[email-masked]> writes:
>
>    Kurt> At 09:58 AM 4/10/2004, Sam Hartman wrote:
>    Hallvard> See above.  Also, Sam's statement that all ANONYMOUS
>    Hallvard> users have the _same_ authorization ID, not _no_
>    Hallvard> authorization ID.  Which made me realize that anonymous
>    Hallvard> auth is not a SASL term, but one I'm used to from LDAP,
>    Hallvard> where it means the same as no auth.  OTOH, FTP (at least
>    Hallvard> on Unix) implements anonymous auth the way Sam
>    Hallvard> describes: A specific user on the server's system, with
>    Hallvard> limited access.
>    >>  I think my statement is still generally true.  It may happen
>    >> that the authorization ID of anonymous users is also the same
>    >> as the authorization ID of users who have engaged in no
>    >> authentication exchange.
>
>    Kurt> But here you are talking about some authorization ID which
>    Kurt> the service merely associates with the state of being
>    Kurt> anonymous (having an unknown or concealed identity).  
>
>Agree.d
>
>    Kurt> This
>    Kurt> is quite different than saying that anonymous users have
>    Kurt> established (authenticated) THEIR identity in the service.
>
>I don't see the difference.  IN both cases, the identity (or
>non-identity) you are authorized as establishes your privileges in the
>system.

The difference is that, when using ANONYMOUS, users don't
establish THEIR identity, they establish some factor in the
server which allows them access without requiring that they
establish THEIR identity.  Sure, a system can associate
some identity representation to all users which have not
established THEIR identity, but that DOES NOT imply the
user has established THEIR identity.

And, I would hope, we can agree on whether or not the
system does associate some identity representation to
all users which not established THEIR identities or
not, or what that identity representation might be,
is completely beyond the scope of this mechanism.
Just as what authorization identity representation the
system might associate with an user who DOES establish
their identity is beyond the scope of the mechanism.

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Sat, 10 Apr 2004 13:47:08 -0700

I need to slow down...