Subject: [http-auth] I-D Action: draft-ietf-httpauth-extension-02.txt

From: [email-masked]
Date: Mon, 18 Aug 2014 19:29:06 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Hypertext Transfer Protocol Authentication Working Group of the IETF.

        Title           : HTTP Authentication Extensions for Interactive Clients
        Authors         : Yutaka Oiwa
                          Hajime Watanabe
                          Hiromitsu Takagi
                          Tatsuya Hayashi
                          Yuichi Ioku
	Filename        : draft-ietf-httpauth-extension-02.txt
	Pages           : 24
	Date            : 2014-08-18

Abstract:
   This document specifies a few extensions of HTTP authentication
   framework for interactive clients.  Recently, fundamental features of
   HTTP-level authentication is not enough for complex requirements of
   various Web-based applications.  This makes these applications to
   implement their own authentication frameworks using HTML Forms and
   other means, which becomes one of the hurdles against introducing
   secure authentication mechanisms handled jointly by servers and user-
   agent clients.  The extended framework fills gaps between Web
   application requirements and HTTP authentication provisions to solve
   the above problems, while maintaining compatibility against existing
   Web and non-Web uses of HTTP authentications.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-httpauth-extension/

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-httpauth-extension-02

A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=draft-ietf-httpauth-extension-02

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Yutaka OIWA <[email-masked]>
Date: Tue, 19 Aug 2014 13:31:42 +0900

Dear all,

as promised in Toronto,
I submitted the revised version of httpauth-extension draft.

In this revision, the following are changed:

 * Multiple scheme challenge is supported, and
 * Added the "realm" parameter. These look like the following:
   (use of obsolete multi-line header is for line-wrapping readability only)

   WWW-Authenticate: Basic realm="test",
                     Basic realm="test2",
                     Digest realm="test", qop=int, ...
   Authentication-Control: Basic realm="test", auth-style=modal,
                           Basic realm="test2", no-auth=true,
                           Digest realm="test", auth-style=modal

 * Support for username which is the same as the Michael's proposal
   for non-Basic auth schemes as well.

   WWW-Authenticate: Digest realm="test", qop=int, ...
   Authentication-Control: Digest realm="test", username="admin"

2014-08-19 11:29 GMT+09:00  <[email-masked]>:
> _______________________________________________
> http-auth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/http-auth

-- 
Yutaka OIWA, Ph.D.                 Leader, System Life-cycle Research Group
                               Research Institute for Secure Systems (RISEC)
     National Institute of Advanced Industrial Science and Technology (AIST)
                       Mail addresses: <[email-masked]>, <[email-masked]>
OpenPGP: id[440546B5] fp[7C9F 723A 7559 3246 229D  3139 8677 9BD2 4405 46B5]