Subject: What's the mechanism for adding new error codes?

From: "Kevin J. Dyer" <[email-masked]>
Date: Thu, 09 Dec 1999 18:08:50 -0500

When Mike Spreitzer <[email-masked]> asked about
standardized authorization and authentication in HTTP something
rang a bell.  I've been part of a group to implement authentication
and authorization using either static or one-time passwords
depending on the remote location and or resource requested for
an in-house system.  We've had to overload return codes (4XX and
5XX), use convoluted HTML hacks, or create out of band
connections in order to achieve the simple challenge response
mechanisms that most of us are use to everyday when a
password has expired or a token needs resynchronized.

With the world moving more toward a browser as their desktop
for large scale collaboration efforts.  How do we as developers
and content providers let a user know that his or her password
has expired or that they are required to change their password
because their temporary password was just that
"TEMPORARY"?  You can make the providers / developers
write workarounds that use HTML / Java, but it's not fixing the
problem.  The solution seems to be we add or enhance the
error returns that are in the protocol to allow for greater
flexibility.

What is the mechanism that will allow someone or group
to add new error codes to the HTTP protocol?  Are the
individual W3O working groups like WWW security or
WEBDAV tasked with adding each of their own codes
and how do we referee the conflicts?

Some examples:

	4XX   Password Change Required

		Self explanatory.

	4XX   Next Passcode or Token

		For use with one-time password smart
		cards like Axent or SecurID

	4XX   Reauthentication required

		Arguably can use a 401, but this should allow
		for more information to be displayed in the
		pop-up / applet.

and I know there have been others that have bounced through this
list as well.

			Just a thought before we close up shop!

					Kevin Dyer
					
===========================================================
Kevin J. Dyer				     Draper Laboratory  MS 35
Email: <[email-masked]>		     555 Tech. Sq.
Phone: 617-258-4962			     Cambridge, MA 02139
FAX: 617-258-2061
---------------------------------------------------------------------------- 
------------------------------------------
	    _/_/_/_/    _/          _/  _/  _/        _/     _/_/_/_/
	   _/      _/   _/_/     _/_/  _/  _/_/     _/   _/
	  _/       _/  _/ _/   _/ _/  _/  _/  _/   _/    _/_/_/
	 _/      _/   _/  _/ _/  _/  _/  _/    _/ _/            _/
	_/_/_/_/   _/    _/    _/  _/  _/        _/  _/_/_/_/
        Data Management & Information Navigation Systems
===========================================================

---

From: Rohit Khare <[email-masked]>
Date: Thu, 9 Dec 1999 15:45:14 -0800

http://www.ietf.org/internet-drafts/draft-ietf-tls-http-upgrade-04.txt

is awaiting IESG  announcement of an Internet-wide last call -- it 
was LC'd at TLS-WG and here.  It will establish a new IANA registry 
for new reply codes.

Policies, forms, etc. can be found there...

Thanks,
Rohit

PS. I'm conspicuously ducking the question of whether your intended 
application is "correct" or not; this is just an answer to the 
question of "how"...

---

From: "Kevin J. Dyer" <[email-masked]>
Date: Mon, 13 Dec 1999 11:27:50 -0500

At 06:45 PM 12/9/99 , Rohit Khare wrote:

>is awaiting IESG  announcement of an Internet-wide last call -- it was 
>LC'd at TLS-WG and here.  It will establish a new IANA registry for new 
>reply codes.

Thanks,  I did notice the error registry component since the main topic of 
the draft was TLS.

>application is "correct" or not; this is just an answer to the question of 
>"how"...

Question to the group:  Should we set aside a block of error codes in each 
range for local requirements?  I compare this to
                          the reserved blocks of IP addresses for us behind 
NATs or standalone systems.
===========================================================
Kevin J. Dyer				     Draper Laboratory  MS 35
Email: <[email-masked]>		     555 Tech. Sq.
Phone: 617-258-4962			     Cambridge, MA 02139
FAX: 617-258-2061
---------------------------------------------------------------------------- 
------------------------------------------
	    _/_/_/_/    _/          _/  _/  _/        _/     _/_/_/_/
	   _/      _/   _/_/     _/_/  _/  _/_/     _/   _/
	  _/       _/  _/ _/   _/ _/  _/  _/  _/   _/    _/_/_/
	 _/      _/   _/  _/ _/  _/  _/  _/    _/ _/            _/
	_/_/_/_/   _/    _/    _/  _/  _/        _/  _/_/_/_/
        Data Management & Information Navigation Systems
===========================================================