Subject: EXTERNAL security considerations

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Sun, 15 Apr 2001 20:50:16 -0700

It seems to me that there some security considerations
which should be noted regarding the EXTERNAL mechanism.

First, I think:
   The server uses information, external to SASL, ...

is a bit too value.  I suggest:
   The server uses authenticated information, external to SASL,

That is, the information used must be verified though
some external authentication process.  The information
should not be easily spoofed, such as the client's
IP address, the DNS name found by reverse lookup, or
information obtained from services operating at this
IP address (such as an RFC1413) authentication service.

I actually suggest EXTERNAL be limited provided by other
means established by the application protocol profile.

Without this, then it would be necessary to state additional
considerations in regards to the client's use of EXTERNAL.
In particular, the client cannot assume the source of
information used by server.

Comments?

Kurt