Subject: Re: [http-auth] Allowed Characters in usernames and passwords

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Mon, 8 Dec 2014 08:34:45 -0500

Thanks Julian,

I will use the same text with the Digest document.

Regards,
 Rifaat

On Sun, Nov 30, 2014 at 6:23 PM, Peter Saint-Andre - &yet <[email-masked]>
wrote:

> On 11/30/14, 4:00 PM, Julian Reschke wrote:
>
>> On 2014-11-30 23:32, Peter Saint-Andre - &yet wrote:
>>
>>> On 11/30/14, 3:26 PM, Julian Reschke wrote:
>>>
>>>> On 2014-11-25 21:08, Yoav Nir wrote:
>>>>
>>>>>
>>>>>  On Nov 25, 2014, at 10:02 PM, Nico Williams <[email-masked]>
>>>>>> wrote:
>>>>>>
>>>>>> On Tue, Nov 25, 2014 at 1:56 PM, Yoav Nir <[email-masked]>
>>>>>> wrote:
>>>>>>
>>>>>>> To re-summarize, the proposal was that servers MUST support
>>>>>>> usernames and passwords compliant with saslprepbis, and MAY support
>>>>>>> non-compliant characters (except for specialized requirements such
>>>>>>> as those around colon).
>>>>>>>
>>>>>>
>>>>>> What does this mean?  That the client MAY/SHOULD/MUST prep the thing?
>>>>>> How would the server know if the thing is prep'ed with saslprepbis (if
>>>>>> not by applying the prep itself)?  What would it mean for the server
>>>>>> to not "support usernames and passwords compliant with saslprepbis"?
>>>>>>
>>>>>
>>>>> The discussion was about the profiles for usernames and passwords in
>>>>> sections 3.2 and 4.2 respectively of
>>>>> https://tools.ietf.org/html/draft-ietf-precis-saslprepbis-10 .
>>>>>
>>>>
>>>> In draft-11, there's a choice of "UsernameCaseMapped" and
>>>> "UsernameCasePreserved"
>>>>
>>>
>>> Yes, I added the options so that we'd all have definitive options (and
>>> so that UsernameCaseMapped wasn't defined in an XMPP specification).
>>>
>>>  - I assume we'll choose the latter...
>>>>
>>>
>>> Probably.
>>>
>>> Peter
>>>
>>
>> OK, for now I have this change
>> <http://trac.tools.ietf.org/wg/httpauth/trac/changeset/83#file1> - note
>> that it only applies for the case where the server has advertised UTF-8
>> support using the charset parameter.
>>
>
> Yes, I had always assumed so.
>
>  Are we ok with this -- that is, can I submit a new draft and declare
>> victory?
>>
>
> I think so. [1]
>
> Thanks for your patience and persistence!
>
> Peter
>
> [1] It is possible that we might try to consolidate or harmonize some of
> the profiles of the PRECIS FreeformClass, as we have done for profiles of
> the IdentifierClass. However, I expect that won't change the substance of
> the Password profile.
>
>
> _______________________________________________
> http-auth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/http-auth
>

---

From: Peter Saint-Andre - &yet <[email-masked]>
Date: Mon, 08 Dec 2014 06:39:28 -0700

> I will use the same text with the Digest document.

Note that in draft-ietf-saslprepbis we changed the name of the profile 
from "Password" to "OpaqueString" to encourage broader re-use. The 
profile itself did not change at all.

Peter

---

From: Peter Saint-Andre - &yet <[email-masked]>
Date: Mon, 08 Dec 2014 06:41:06 -0700

On 12/8/14, 6:39 AM, Peter Saint-Andre - &yet wrote:
> Note that in draft-ietf-saslprepbis

Er, draft-ietf-precis-saslprepbis, that is.

> we changed the name of the profile

---

From: Julian Reschke <[email-masked]>
Date: Mon, 08 Dec 2014 14:57:58 +0100

> profile itself did not change at all.

I changed that in my current edits: 
<http://trac.tools.ietf.org/wg/httpauth/trac/changeset/85>

Best regards, Julian