Subject: Re: [Ietf-http-auth] Whay is caldav special?
From: "Diego R. Lopez" <[email-masked]>
To: [email-masked]
Date: Sun, 02 Oct 2005 23:18:49 +0200
List-Id: ietf-http-auth.osafoundation.org

Hi,

Being the first time I write here, let me briefly introduce myself.
My name is Diego Lopez and I work for the Spanish National Research
Network (RedIRIS). I've been working for some time in our own
federated access control system (PAPI, http://papi.rediris.es/),
and I'm leading the group building eduGAIN, the authentication
and authorization infrastructure of the pan-European academic
network, GEANT2.

>>No, I'm just saying that people do that now and we have to
>>> recognize the reasons why that's done and design a solution
>>> that transitions as cleanly as possible from that.
>>> 
>>> -Ekr
> 
> 
> Then let's start a list of the reasons why sites use forms instead
> of HTTP AUTH:

I think the point is not how the authorization state is maintained
across different HTTP requests/responses, but how the initial
rights to invoke a certain operation are established. Once this
initial phase is performed, the state can be maintained either
by encrypyed cookies, HTTP Auth or whatever other similar method:
they reduce to the same general case of (more or less) protected
contents in the HTTP headers.

Of course one could look for a more ellaborated or general way of
dealing with this authorization headers, but I think the real challenge
here is to look for a way of expressing access requirements and rights
in the initial interaction, much like HTTP Auth does now, but with the
richer semantics that what some of you call "forms-and-cookies approach"
allows.

Be goode,
-- 
"Esta vez no fallaremos, Doctor Infierno"

Dr Diego R. Lopez

Red.es - RedIRIS
The Spanish NREN

e-mail: [email-masked]
jid:    [email-masked]
Tel:    +34 955 056 621
Mobile: +34 669 898 094
-----------------------------------------