Subject: 2222bis: identities and authorization

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Fri, 13 Aug 2004 09:34:04 +0200

I have completed my review of draft-ietf-sasl-rfc2222bis-08.txt,
resulting in mostly minor editorial comments (which I have
separately sent to the Editor).  This note discussions problems
I found related to identities and authorization.

The 'Authorization and authentication identities' section (3.2)
starts off by stating that 'SASL authentication deals with
two identities' but then describes the processing model to
involve three identities, two of which it simply refers to
as 'authorization' identities.  I believe we either need
better distinguish these identities within the document,
by through qualification (proxy authorization identity
v. application authorization identity) or by use of
replacement terminology (proxied identity v. authorization
identity).  I prefer the latter approach as the former
qualifications are themselves a bit confused and the
latter seems more in step with RFC 2828.

I am willing to prepare replacement text for consideration.

Kurt