Subject: [lemonade] URLAUTH 01 and UIDVALIDITY

From: [email-masked]
Date: Wed, 29 Sep 2004 21:17:11 -0500

Should UIDVALIDITY be mandatory?

If by chance the granting server invalidates the UIDVALIDITY after generating the URL how does the resolving (same as the granting) server know if the UID is valid unless there is a UIDVALIDITY value? Maybe the server would do an implicit RESETKEY when it knew it had invalidated the UIDVALIDITY.

Additionally, according to RFC3501 2.3.1.1, a server can legitimately change UIDVALIDITY every session if it can not retain UIDs. Is it intended that URLAUTH be allowed to work with such a server? I suppose the answer is that such a server would never include URLAUTH in it's capability string.

Mike

_______________________________________________
lemonade mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/lemonade

---

From: Mark Crispin <[email-masked]>
Date: Wed, 29 Sep 2004 22:24:43 -0700 (PDT)

On Wed, 29 Sep 2004 [email-masked] wrote:
> If by chance the granting server invalidates the UIDVALIDITY after 
> generating the URL how does the resolving (same as the granting) server 
> know if the UID is valid unless there is a UIDVALIDITY value? Maybe the 
> server would do an implicit RESETKEY when it knew it had invalidated the 
> UIDVALIDITY.

Yes, I think that most (if not all) scenarios that involve a server 
changing UIDVALIDITY would also reset the keys.

> Additionally, according to RFC3501 2.3.1.1, a server can legitimately 
> change UIDVALIDITY every session if it can not retain UIDs. Is it 
> intended that URLAUTH be allowed to work with such a server?

I don't think that URLAUTH can work with such a server.

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.
Si vis pacem, para bellum.