Subject: authmeth: SASL protocol profile

From: Hallvard B Furuseth <[email-masked]>
Date: Thu, 6 Nov 2003 00:28:40 +0100

About Authmeth Section 3.3 (SASL Authentication Profile):

According to [SASL], the LDAP protocol profile must explicitly mention
- that LDAP supports "multiple authentications",
- the form of the authorization identity,
and SHOULD specify use of SASLPrep.

Sections 3.3.5 (Rules for using SASL security layers) and 3.3.6 (Use of
EXTERNAL SASL Mechanism) should be removed or moved away from the
protocol profile.  Unless I've gone blind, the [SASL] protocol profile
requirements do not mention them.

I think section 3.3 should be renamed 'SASL Protocol Profile', so
readers of [SASL] can _find_ the 'protocol profile' by searching the
authmeth document for that phrase.

A suggestion in my 'authmeth-07 issues' message was bogus:  To move
section 3.3.3 (Octet where negotiated security mechanisms take effect)
away from the protocol profile section.  I hadn't realized what a
protocol profile was when I said that.

-- 
Hallvard

---

From: Alexey Melnikov <[email-masked]>
Date: Tue, 11 Nov 2003 19:12:35 +0000

Hallvard B Furuseth wrote:

>protocol profile.
Actually I disagree. Section 3.3.5 definitely belongs to the protocol 
profile.
3.3.6 might be stating obvious, but it reminds that EXTERNAL [based on 
TLS] must not be allowed until a client certificate was presented during 
TLS handshake.

>  Unless I've gone blind, the [SASL] protocol profile
I agree.

>protocol profile was when I said that.

Alexey
__________________________________________
Isode Limited, http://www.isode.com

IETF standard related pages:
http://www.melnikov.ca/mel/devel/Links.html
__________________________________________