Subject: rfc2222bis: EXTERNAL description

From: Hallvard B Furuseth <[email-masked]>
Date: Fri, 15 Oct 2004 02:26:02 +0200

> 7.    The EXTERNAL mechanism

>   The client sends a single message containing the UTF-8 encoding of
>   the

Maybe add 'requested'?

>   authorization identity. The message may be empty. The form of the
>   authorization identity is further restricted by the application-level
>   protocol's SASL profile.

s/is further/may be/.  (Further restricted than what?  Being empty?:-)
Though I'd move that last sentence to the last paragraph (below) so all
handling of the authorization identity is in one place.

These paragraphs can be shortened a bit now that 'authentication
identities' have been introduced:

>   The server uses information, external to SASL, to determine whether
>   the client is permitted to authenticate as the authorization
>   identity.  If the client is so authorized, the server indicates
>   successful completion of the authentication exchange; otherwise the
>   server indicates failure.

    The server uses information external to SASL to determine the
    authentication identity and whether the authentication is to
    succeed.  It then indicates completion or failure of the
    authentication exchange.

>   If the client sends the empty string as the authorization identity,
>   the authorization identity is to be derived from authentication
>   credentials which exist in the system that is providing the external
>   authentication.

    If the requested authorization identity is empty, the authorization
    identity is to be derived from the authentication identity.

-- 
Hallvard

---

From: Alexey Melnikov <[email-masked]>
Date: Thu, 21 Oct 2004 16:47:54 +0100

>>  The client sends a single message containing the UTF-8 encoding of
Using "requested" here is Ok, IMHO.

>s/is further/may be/.  (Further restricted than what?  Being empty?:-)
Ok.

>    succeed.
Although this implies the same thing (if you take into consideration 
implied authorization step), I would prefer the original text.

>  It then indicates completion or failure of the
>    authentication exchange.
>
Here is the latest text for SASL EXTERNAL. This is not exactly what 
you've asked, but let me know what you think:

The mechanism name associated with external authentication is "EXTERNAL".

The client sends a single message containing the UTF-8 encoding of the 
requested authorization identity. The message may be empty. The form of 
the authorization identity may be restricted by the application 
protocol's SASL profile.

The server uses information, external to SASL, to determine whether the 
client is permitted to act as the authorization identity.  (If the 
requested authorization identity is empty, the authorization identity is 
to be derived from authentication credentials which exist in the system 
that is providing the external authentication.) If the client is 
permitted to do so, the server indicates successful completion of the 
authentication exchange; otherwise the server indicates failure.

The system providing this external information may be, for example, 
IPSec [IPSec] or TLS [TLS]. However, the client can make no assumptions 
as to what information the server can use in determining client 
authorization. For example, just because TLS was established, doesn't 
mean that the server will use the information provided by TLS.

Alexey

---

From: Hallvard B Furuseth <[email-masked]>
Date: Thu, 21 Oct 2004 19:22:35 +0200

> implied authorization step), I would prefer the original text.

Well, SASL mechanisms are now supposed to set an authentication
identity, but EXTERNAL in the original or in your form doesn't.
(I wish I'd realized that before posting.)

OTOH, mixing rfc2222's paragraph 5 (authz id) into paragraph 3 was very
nice, and my text should not have lost the 'system' doing
authentication.

If I mix your text and mine a bit, does this cover all bases?

  Some system external to SASL must authenticate the client.  If that
  succeeds, the server determines the authentication identity from
  information from this system.  If the requested authorization identity
  is empty, the authorization identity is derived from the
  authentication identity.  The server determines if the authentication
  identity is allowed to act as the authorization identity.  Finally, it
  indicates completion or failure of the authentication exchange.

Or replace the last sentence with

  If all that succeeds, the server indicates successful completion of
  the authentication exchange; otherwise it indicates failure.

Sigh.  And this started with trying to make the text _shorter_:-)

-- 
Hallvard

---

From: Alexey Melnikov <[email-masked]>
Date: Fri, 22 Oct 2004 15:55:43 +0100

Hallvard B Furuseth wrote:

>[...]
That would work for me.

> Sigh.  And this started with trying to make the text _shorter_:-)
It usually does :-).

---

From: Alexey Melnikov <[email-masked]>
Date: Thu, 21 Oct 2004 16:47:54 +0100

Ok.

Alexey

---

From: Hallvard B Furuseth <[email-masked]>
Date: Thu, 21 Oct 2004 19:22:35 +0200

-- 
Hallvard

---

From: Alexey Melnikov <[email-masked]>
Date: Fri, 22 Oct 2004 15:55:43 +0100

That would work for me.

It usually does :-).