Subject: Re: [http-auth] Why is there no SASL support in HTTP?

From: Rick van Rein <[email-masked]>
Date: Mon, 14 Aug 2017 18:19:31 +0200

Hello former WG,

In Januari I wrote...

> I've been wondering why HTTP Authentication does not support SASL, but
> instead chooses independent mechanisms from SASL?

...and given the positive replies back then, I have now written a draft
to cover this idea.

https://datatracker.ietf.org/doc/draft-vanrein-httpauth-sasl/

Related to this is a proposal that can be helpful to pass SASL over EAP
to (shared) backend infrastructure,

https://datatracker.ietf.org/doc/draft-vanrein-eap-sasl/

It includes channel binding, which AFAIK is new to HTTP, but SASL is
clear about how to do this: skip over the application protocol and
incorporate TLS through tls-unique, as a minimum mechanism.  So the
reasoning for SCRAM-* to not support it because HTTP does not define it,
does not seem to apply here.  I hope I'm not poking in a hornet's nest
by saying this...

Given that the HTTPAUTH WG has been dismantled, I am not sure what to do
next.  Any advise is welcome.

Best wishes,

Rick van Rein
InternetWide.org / ARPA2.net / OpenFortress.nl

---

From: Yoav Nir <[email-masked]>
Date: Mon, 14 Aug 2017 20:52:07 +0300

Hi, Rick.

Since this is security-related and does not naturally belong to any existing working group, the way to go is to send a message to the SAAG list (security area advisory group) and see if it generates interest there.

Yoav

> On 14 Aug 2017, at 19:19, Rick van Rein <[email-masked]> wrote:
> 
> Hello former WG,
> 
> In Januari I wrote...
> 
> _______________________________________________
> http-auth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/http-auth