Subject: [xmpp] #54: informational note about SASL authorization identities

From: "xmpp issue tracker" <[email-masked]>
Date: Tue, 22 Jun 2010 01:34:54 -0000

#54: informational note about SASL authorization identities
--------------------------------+-------------------------------------------
 Reporter:  stpeter@…           |       Owner:  stpeter@…         
     Type:  defect              |      Status:  new               
 Priority:  minor               |   Milestone:                    
Component:  3920bis             |     Version:                    
 Severity:  In WG Last Call     |    Keywords:                    
--------------------------------+-------------------------------------------
 Section 6.3.6 contains the following informational note:

 > The authorization identity communicated during SASL
 > negotiation is used to determine the canonical address
 > for the initiating client or server according to the
 > receiving server, as described under Section 4.2.6.

 Matthew Wild commented: "seems like it might contradict 4.2.6 and 6.2.8
 regarding the use of authorization identities, especially in the context
 of s2s."

-- 
Ticket URL: <http://trac.tools.ietf.org/wg/xmpp/trac/ticket/54>
xmpp <http://tools.ietf.org/xmpp/>

---

From: Peter Saint-Andre <[email-masked]>
Date: Thu, 24 Jun 2010 18:47:47 -0600

> #54: informational note about SASL authorization identities

I've looked at this several times but I don't see the contradiction.
Could you please elaborate?

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: "xmpp issue tracker" <[email-masked]>
Date: Fri, 25 Jun 2010 04:14:00 -0000

#54: informational note about SASL authorization identities
--------------------------------+-------------------------------------------
 Reporter:  stpeter@…           |        Owner:  stpeter@…         
     Type:  defect              |       Status:  closed            
 Priority:  minor               |    Milestone:                    
Component:  3920bis             |      Version:                    
 Severity:  In WG Last Call     |   Resolution:  worksforme        
 Keywords:                      |  
--------------------------------+-------------------------------------------
Changes (by stpeter@…):

  * status:  new => closed
  * resolution:  => worksforme

-- 
Ticket URL: <http://trac.tools.ietf.org/wg/xmpp/trac/ticket/54#comment:1>
xmpp <http://tools.ietf.org/xmpp/>

---

From: Matthew Wild <[email-masked]>
Date: Fri, 25 Jun 2010 12:43:53 +0100

On 25 June 2010 01:47, Peter Saint-Andre <[email-masked]> wrote:
>>  > The authorization identity communicated during SASL
>>  > negotiation is used to determine the canonical address
>>  > for the initiating client or server according to the
>>  > receiving server, as described under Section 4.2.6.
>>

Yes, this threw me:

6.3.6 says: "The authorization identity communicated during SASL
negotiation is used to determine the canonical address for the
initiating client or server [...]"
4.2.6 says: "Note that authorization identities are not allowed during
SASL negotiation for server-to-server streams"
6.2.8 says that authorization identities should not be used at all
unless the initiator is acting on behalf of another entity.

Regards,
Matthew

---

From: Peter Saint-Andre <[email-masked]>
Date: Sun, 27 Jun 2010 15:39:51 -0600

> initiating client or server [...]"

I've deleted "or server" here.

> SASL negotiation for server-to-server streams"

Correct.

> unless the initiator is acting on behalf of another entity.

And that is true. However, 6.3.6 is talking about the case where an
authorization identity is communicated, so I think there is no
contradiction between 6.2.8 and 6.3.6.

Peter

-- 
Peter Saint-Andre
https://stpeter.im/