Subject: Half-anonymous authentication

From: Hallvard B Furuseth <[email-masked]>
Date: Tue, 6 Apr 2004 22:05:16 +0200

As far as I can tell, a SASL authentication method may make the
authentication ID _or_ the authorization ID anonymous, but not the
other one.  Is that correct?  Should it be correct?

Non-anonymous authentication ID + anonymous authorization ID seems
useful for the ANONYMOUS mechanism.  Currently, servers that implement
ANONYMOUS must make a special case to ensure that they don't give any
access to apparently authenticated users who used this method.  However,
if ANONYMOUS sets the authorization ID to anonymous, servers will give
anonymous access by default.  That seems a lot safer, though whether it
is a good idea or not depends on what the mechanism is intended to be
used for.  I suggested that some time ago, but got no response - it
drowned in another subthread.

OTOH, I can't think of a use for anonymous authentication ID with
non-anonymous authorization ID, other than those which could just as
well be fulfilled by setting the authentication ID as well.  Like
EXTERNAL.  Don't know if that is any reason to forbid it, though.

-- 
Hallvard