Subject: Re: Comments on draft-burdis-cat-srp-sasl-04

From: [email-masked]
Date: Tue, 8 May 2001 14:26:34 -0700 (PDT)

Excerpts From Keith Burdis <[email-masked]>:
Message
>Hmm. I like the idea of warm and fuzzy users :-) but I am not sure what you 
>mean by \"the client and server send nothing for the remaining steps\" ?

The server sends the last piece of data. In most protocol (SMTP for instance) the client has to send a blank SASL request after this and then the server sends a 235 Authentication successful. Some protocols optimise this roundtrip out but for those that don't I think it's important to say that the client MUST send an empty request.

Thanks,
Tim

---

From: Keith Burdis <[email-masked]>
Date: Wed, 09 May 2001 18:37:42 +0200

Quoting [email-masked]:

> >Hmm. I like the idea of warm and fuzzy users :-) but I am not sure what
> >you mean by "the client and server send nothing for the remaining steps" ?
> 
> The server sends the last piece of data. In most protocol (SMTP for
> instance) the client has to send a blank SASL request after this and
> then the server sends a 235 Authentication successful. Some protocols
> optimise this roundtrip out but for those that don't I think it's
> important to say that the client MUST send an empty request.

Aah I see what you mean. So we should include something like:

"If a protocol using this mechanism allows the server to indicate that 
authentication is successful along with the last piece of data it sends, then 
the server SHOULD do so. However, if the protocol does not allow this then the 
client MUST send an empty request, to which the server will respond with an 
indication that authentication was successful."

> Tim

  - Keith
--
Keith Burdis                        
---

---

From: Keith Burdis <[email-masked]>
Date: Wed, 09 May 2001 18:37:42 +0200

- Keith
--
Keith Burdis                        
---