Subject: [xmpp] #48: SASL mechanism order

From: "xmpp issue tracker" <[email-masked]>
Date: Tue, 22 Jun 2010 00:49:43 -0000

#48: SASL mechanism order
--------------------------------+-------------------------------------------
 Reporter:  stpeter@…           |       Owner:  stpeter@…         
     Type:  defect              |      Status:  new               
 Priority:  minor               |   Milestone:                    
Component:  3920bis             |     Version:                    
 Severity:  In WG Last Call     |    Keywords:                    
--------------------------------+-------------------------------------------
 Section 6.2.3 (Mechanism Preferences) states:

 > Any entity that will act as a SASL client or a SASL server MUST
 > maintain an ordered list of its preferred SASL mechanisms
 > according to the client or server, where the list is ordered by
 > the perceived strength of the mechanisms.  A server MUST offer
 > and a client MUST try SASL mechanisms in the order of their
 > perceived strength.  For example, if the server offers the
 > ordered list "PLAIN DIGEST-MD5 GSSAPI" or "DIGEST-MD5 GSSAPI
 > PLAIN" but the client's ordered list is "GSSAPI DIGEST-MD5", the
 > client MUST try GSSAPI first and then DIGEST-MD5 but MUST never
 > try PLAIN (since PLAIN is not on its list).

 Kevin Smith commented: "I'm not sure MUST here is right - SHOULD seems
 sufficient. I think deployments could reasonably have other priorities
 than perceived strength (perceived by whom?) - such as computational
 expense."

 Dave Cridland commented: ""[...] if the server *erroneously* offers
 [...]", since it's an example of what a server MUST NOT do... I'm hesitant
 in describing this as in strength order, however - I think it's a case of
 preferential order, since "strength" is not only a movable feast, but may
 be outweighed by other factors such as use of SSO facilities."

-- 
Ticket URL: <http://trac.tools.ietf.org/wg/xmpp/trac/ticket/48>
xmpp <http://tools.ietf.org/xmpp/>

---

From: "xmpp issue tracker" <[email-masked]>
Date: Thu, 24 Jun 2010 22:38:10 -0000

#48: SASL mechanism order
--------------------------------+-------------------------------------------
 Reporter:  stpeter@…           |        Owner:  stpeter@…         
     Type:  defect              |       Status:  closed            
 Priority:  minor               |    Milestone:                    
Component:  3920bis             |      Version:                    
 Severity:  In WG Last Call     |   Resolution:  fixed             
 Keywords:                      |  
--------------------------------+-------------------------------------------
Changes (by stpeter@…):

  * status:  new => closed
  * resolution:  => fixed

Comment:

 Provisionally resolved with this text:

 6.2.3.  Mechanism Preferences

    Any entity that will act as a SASL client or a SASL server MUST
    maintain an ordered list of its preferred SASL mechanisms according
    to the client or server, where the list is ordered according to local
    policy or user configuration (which SHOULD be in order of perceived
    strength to enable the strongest authentication possible).  A server
    MUST offer and a client MUST try SASL mechanisms in preference order.
    For example, if the server offers the ordered list "PLAIN SCRAM-SHA-1
    GSSAPI" or "SCRAM-SHA-1 GSSAPI PLAIN" but the client's ordered list
    is "GSSAPI SCRAM-SHA-1", the client MUST try GSSAPI first and then
    SCRAM-SHA-1 but MUST never try PLAIN (since PLAIN is not on its
    list).

-- 
Ticket URL: <http://trac.tools.ietf.org/wg/xmpp/trac/ticket/48#comment:1>
xmpp <http://tools.ietf.org/xmpp/>