Subject: Re: [kitten] WGLC on draft-ietf-kitten-sasl-oauth-12

From: Ryan Troll <[email-masked]>
Date: Mon, 6 Jan 2014 16:09:39 -0800

>
>
> MAJOR:
>
> * Removing the GS2-header (which was done in revision -11) also removed
> the ability for the client to specify an authorization identity.  If the
> lack of an authorization identity is acceptable (and I suspect it is not
> for some), then the document needs to state these mechanisms do not support
> authz-id.

The loss of the authz-id is a problem for us.  Last year we discussed the
use case with the list, came to the conclusion that what our use case
needed was access to the authz-id; and agreed that we'd pull it from the
GS2-header.

Now that the GS2-header is gone, it would be beneficial to provide a
standard, but optional, way for clients to provide the authz-id to the
service.  This would ensure compatibility across services which require the
authz-id; while not requiring it for *all* SASL-OAuth clients.

The original proposal had been to define a reserved keyword ("user") which
could be part of the initial client response.  Should this be re-added?

-R

---

From: Bill Mills <[email-masked]>
Date: Mon, 6 Jan 2014 16:23:49 -0800

Now that it's not duplicating the gs2 stuff it makes some sense.  It can be easily added back.

Any objection to adding the "user" field back in?

-bill

--------------------------------
William J. Mills
"Paranoid" Yahoo!

On Monday, January 6, 2014 4:10 PM, Ryan Troll <[email-masked]> wrote:

>MAJOR:
>
>* Removing the GS2-header (which was done in revision -11) also removed the ability for the client to specify an authorization identity.  If the lack of an authorization identity is acceptable (and I suspect it is not for some), then the document needs to state these mechanisms do not support authz-id.

The loss of the authz-id is a problem for us.  Last year we discussed the use case with the list, came to the conclusion that what our use case needed was access to the authz-id; and agreed that we'd pull it from the GS2-header.

Now that the GS2-header is gone, it would be beneficial to provide a standard, but optional, way for clients to provide the authz-id to the service.  This would ensure compatibility across services which require the authz-id; while not requiring it for *all* SASL-OAuth clients.

The original proposal had been to define a reserved keyword ("user") which could be part of the initial client response.  Should this be re-added?

-R

_______________________________________________
Kitten mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/kitten

---

From: Bill Mills <[email-masked]>
Date: Mon, 6 Jan 2014 16:25:08 -0800

That said, your extant implementation might argue for leaving the GS2 header in there...

-bill

On , Bill Mills <[email-masked]> wrote:

-bill

-R