Subject: Basic auth and realms

From: Adrien de Croy <[email-masked]>
Date: Mon, 16 Jun 2008 11:27:28 +1200

Hi all. 

I've been looking through RFC2617 to try and track down some issues with 
basic auth to our proxy.

The specification makes it a requirement that any auth challenge must 
include at least one auth param.

    challenge = auth-scheme 1*SP 1#auth-param

in the case of Basic, the realm parameter is required.

The description of this realm parameter is confusing.  Especially when 
considering a proxy.  Commonly a proxy will want a realm that means 
"everywhere".  How should one specify this?  would it be

realm="/"
realm="*"

or what?  From 2617 s1.2

"The realm directive (case-insensitive) is required for all 
authentication schemes that issue a challenge. The realm value 
(case-sensitive), in combination with the canonical root URL (the 
absoluteURI for the server whose abs_path is empty; see section 5.1.2 of 
[2]) of the server being accessed, defines the protection space. "

This talks about an origin server.  It doesn't make sense for a proxy.  
Realm seems to only be usable within a single server space.  Do clients 
commonly deem the server in this case to be the proxy?

Browsers seem to behave differently in regards to when they will 
automatically re present the same proxy credentials.

Regards

Adrien

-- 
Adrien de Croy - WinGate Proxy Server - http://www.wingate.com

---

From: Bjoern Hoehrmann <[email-masked]>
Date: Mon, 16 Jun 2008 01:59:32 +0200

* Adrien de Croy wrote:
>or what?

Section 2 for Basic notes "The realm value should be considered an
opaque string which can only be compared for equality with other
realms on that server." Meaning it does not matter which string you
use as far as the protocol is concerned.

>[2]) of the server being accessed, defines the protection space. "

This is talking about tuples

  { 'http://example.com', 'Realm 1' }, # Protection space 1
  { 'http://example.com', 'Realm 2' }, # Protection space 2
  { 'http://example.com', 'Realm 3' }, # Protection space 3
  ...

>automatically re present the same proxy credentials.

The specification just says

  Similarly, when a client sends a request to a proxy, it may reuse a
  userid and password in the Proxy-Authorization header field without
  receiving another challenge from the proxy server.

So they are indeed free to differ in this regard.
-- 
Björn Höhrmann · mailto:[email-masked] · http://bjoern.hoehrmann.de
Weinh. Str. 22 · Telefon: +49(0)621/4309674 · http://www.bjoernsworld.de
68309 Mannheim · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/

---

From: Adrien de Croy <[email-masked]>
Date: Tue, 17 Jun 2008 11:11:24 +1200

Hi Bjoern

thanks for your reply, there are a few things I still don't understand 
though

> use as far as the protocol is concerned.
How does that fit with appending the realm to a base URI to get a 
"protection space".  to me it seems that indicates that the realm should 
be like a folder on a webserver.  The credentials may be automatically 
re-presented for any URL that maps to a resource in that folder (or any 
sub-folders).

since the client doesn't present the realm back to the server, its 
status as opaque string seems rather pointless.  The server can't refer 
back to it.

so the only thing that can use the realm is the client - and for 
comparison to other realms only? 

How then can the client decide whether to try the credentials or not if 
it cannot apriori calculate whether the next URI request will be in the 
same realm as some previous realm?

Adrien

---

From: Bjoern Hoehrmann <[email-masked]>
Date: Tue, 17 Jun 2008 02:25:00 +0200

>re-presented for any URL that maps to a resource in that folder (or any 

"Combination" here does not mean textual concatenation. Read it like you
would read "A specific latitude in combination with a specific longitude
identifes a precise position on the Earth's surface".

>same realm as some previous realm?

It cannot do that, it can only make certain assumptions as suggested in
the specification, for example, "A client SHOULD assume that all paths
at or deeper than the depth of the last symbolic element in the path
field of the Request-URI also are within the protection space specified
by the Basic realm value of the current challenge."
-- 
Björn Höhrmann · mailto:[email-masked] · http://bjoern.hoehrmann.de
Weinh. Str. 22 · Telefon: +49(0)621/4309674 · http://www.bjoernsworld.de
68309 Mannheim · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/

---

From: Adrien de Croy <[email-masked]>
Date: Tue, 17 Jun 2008 12:56:56 +1200

> identifes a precise position on the Earth's surface".
OK, so the 2 are associated in some way other than concatenation.  
thanks for that clarification.

> by the Basic realm value of the current challenge."
I guess this limits the usability of the realm then.  Shame it's 
mandatory for all auth methods that issue a challenge (e.g. also Digest).

All I've seen a browser do with it is display it in the login dialog (in 
brackets).  So it seems purely cosmetic.

Does anyone know what browsers do with realms relating to authenticating 
to a proxy?

from what I can tell IE6 basically ignores the realm and retries 
credentials for a proxy.  IE7 does not, and if you don't specify a 
realm, it doesn't re-present credentials.  If you do specify one, it 
seems to re-present the same credentials for all sites (which is 
sensible IMO).  I'd need to check other browsers.

thanks for your help

Adrien