Subject: [kitten] OAUTH Gssapi mechanism

From: Chaskiel Grundman <[email-masked]>
Date: Sat, 29 Sep 2012 09:35:49 -0400

I recently read this document (after hacking on some code to use
google's xoauth mechs in imap), and I have some questions/comments
about the gssapi section.

>OAuth mechanims security contexts always have the mutual_state flag
>   (GSS_C_MUTUAL_FLAG) set to TRUE.
>   The mutual authentication property of this mechanism relies on
>  successfully comparing the TLS server identity with the negotiated
>   target name.

While this may be true of OAUTH10A when signatures are used, I don't
see how it can be the case with OAUTHBEARER. What negotiated target
name?

> OAuth supports a standard generic name syntax for acceptors, such as
> GSS_C_NT_HOSTBASED_SERVICE (see [RFC2743], Section 4.1).  These
> service names MUST be associated with the "entityID" claimed by the
> RP.
These (SAML-ish) terms are not mentioned anywhere else in this document.

---

From: William Mills <[email-masked]>
Date: Sat, 29 Sep 2012 09:02:16 -0700 (PDT)

I'm gonna have to defer to Hannes on this, but I believe that the negotiated target name in this case is the endpoint receiving the connection and authenticated by the SSL certificate.  Not sure on entityID.

-bill

>________________________________
> From: Chaskiel Grundman <[email-masked]>
>To: [email-masked] 
>Sent: Saturday, September 29, 2012 6:35 AM
>Subject: [kitten] OAUTH Gssapi mechanism
> 
>_______________________________________________
>Kitten mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/kitten
>
>
>

---

From: "Cantor, Scott" <[email-masked]>
Date: Sat, 29 Sep 2012 17:06:43 +0000

On 9/29/12 12:02 PM, "William Mills" <[email-masked]> wrote:
>
>I'm gonna have to defer to Hannes on this, but I believe that the
>negotiated target name in this case is the endpoint receiving the
>connection and authenticated by the SSL certificate.  Not sure on
>entityID.

You must have copied text from my spec, that's where "entityID" came from.

-- Scott

---

From: William Mills <[email-masked]>
Date: Sat, 29 Sep 2012 15:09:48 -0700 (PDT)

I'm not exactly sure where that text came from.  Whether it's mine or Hannes'.

> From: "Cantor, Scott" <[email-masked]>
>To: William Mills <[email-masked]>; Chaskiel Grundman <[email-masked]>; "[email-masked]" <[email-masked]> 
>Sent: Saturday, September 29, 2012 10:06 AM
>Subject: Re: [kitten] OAUTH Gssapi mechanism
>