Subject: rfc2222bis: EXTERNAL description

From: Hallvard B Furuseth <[email-masked]>
Date: Fri, 15 Oct 2004 02:26:02 +0200

> 7.    The EXTERNAL mechanism

>   The client sends a single message containing the UTF-8 encoding of
>   the

Maybe add 'requested'?

>   authorization identity. The message may be empty. The form of the
>   authorization identity is further restricted by the application-level
>   protocol's SASL profile.

s/is further/may be/.  (Further restricted than what?  Being empty?:-)
Though I'd move that last sentence to the last paragraph (below) so all
handling of the authorization identity is in one place.

These paragraphs can be shortened a bit now that 'authentication
identities' have been introduced:

>   The server uses information, external to SASL, to determine whether
>   the client is permitted to authenticate as the authorization
>   identity.  If the client is so authorized, the server indicates
>   successful completion of the authentication exchange; otherwise the
>   server indicates failure.

    The server uses information external to SASL to determine the
    authentication identity and whether the authentication is to
    succeed.  It then indicates completion or failure of the
    authentication exchange.

>   If the client sends the empty string as the authorization identity,
>   the authorization identity is to be derived from authentication
>   credentials which exist in the system that is providing the external
>   authentication.

    If the requested authorization identity is empty, the authorization
    identity is to be derived from the authentication identity.

-- 
Hallvard