Subject: CAP: MUST anonymous auth?

From: John Stracke <[email-masked]>
Date: Thu, 16 Aug 2001 14:33:49 -0400

CAP section 2.4.2.2 says that an implementation MUST support anonymous 
authentication. Why? Why should a CS whose owners don't have any content 
they're going to expose to anonymous users have code for anonymous auth?

Also, in section 7.1.3.1, which discusses anon auth, it says "The user's 
normal UPN MUST not be used for the subsequent CAP operations". (a) Why 
not? (b) What happens if it is used? (c) Should that be "MUST NOT"?

-- 
/=================================================================\
|John Stracke    | http://www.ecal.com |My opinions are my own.   |
|Chief Scientist |================================================|
|eCal Corp.      |It's not an optical illusion, it just looks like|
[email-masked] <mailto:[email-masked]>|one.                                            |
\=================================================================/

---

From: George Babics <[email-masked]>
Date: Thu, 23 Aug 2001 09:49:47 -0400

I do not know why it is a must. Perhaps looking in the archives
or people who were with CAP from the start can let us know.

The CAP requirements document only states that CAP must specify
how one can do anonymous login. It does not state that all
implementations MUST support it.

Even if all implementations MUST support it the CS owners can
deny anonymous logins.

George

---

From: George Babics <[email-masked]>
Date: Thu, 23 Aug 2001 09:49:47 -0400

George

---

From: John Stracke <[email-masked]>
Date: Mon, 27 Aug 2001 10:56:07 -0400

>implementations MUST support it.
OK, good.

>Even if all implementations MUST support it the CS owners can
Mmm, from the protocol point of view, a CS that's configured to deny 
them is an implementation that doesn't support them.  To me, this means 
that, if implementations MUST support them, the owners can't turn them 
off.  That's why I want to see the MUST removed from the spec.

Mandating that implementations contain features that can be turned off 
is not a statement of protocol requirements; it's a statement of market 
requirements .  The IETF does not do marketing.  :-)

-- 
/=================================================================\
|John Stracke    | http://www.ecal.com |My opinions are my own.   |
|Chief Scientist |================================================|
|eCal Corp.      |"How can one conceive of a one party system in a|
[email-masked]|country that has over 200 varieties of cheese?" |
|                |--Charles de Gaulle                             |
\=================================================================/