Subject: Re: Users and Authentication Ids in CAP

From: [email-masked]
Date: Mon, 17 May 1999 19:07:32 GMT

Im a bit behind on my postings to the WG so I appologize...

Alex penned:
>SASL provides an authorization mechanism which fulfills these needs.
>I can authenticate using any of a number of authentication mechanisms,
>and then authorize to the caladdress which I use.

Actually from my readings of the SASL specs I dont quite agree w/the last
bit on authorization.  Its easy to do the authentication (ie: I pass the
relevant info to the CS and we both agree on who each other is).  Its not
in the SASL framework on proving _authorization_.  SASL does not provide a
way for the CS to 'know' that I really can be a proxy for Alex (or visa
versa).  That kind of information is meta information that needs to be
conveyed and managed some other way.

For example, if I can authenticate w/Alex's CS and I tell it Im acting on
his behalf, the CS needs to have some way to verify this (explicitly or
implicitly).  The explict case could be something like Alex creates and
maintains a "proxy" or "delegate" list that the CS can double check with.
The implicit case could be that the CS uses CAR info to infer that I can
infact be "manager" of his calendar(s) and as such can be his "proxy".

SASL provides a way in some schema to pass my request to the CS to be
someones proxy but it does not provide the means to _verify_ this info.  Be
careful of this distinction; it will bite ya if you dont.

In the mean time, perhaps we need to add this kind of 'proxy' or
authorization type info to the vCAR design.  I havent seen it lately so it
may already be there...

Bruce
===========================================================================
Bruce Kahn                                INet: [email-masked]
Iris Associates                          Phone: 978.392.5335
Westford, MA, USA 01886                    FAX: and nothing but the FAX...
Standard disclaimers apply, even where prohibited by law...

---

From: Alexander Taler <[email-masked]>
Date: Tue, 18 May 1999 12:59:48 -0400

> >and then authorize to the caladdress which I use.

[snip] 

> careful of this distinction; it will bite ya if you dont.

Perfectly correct, the server must handle the verification itself.  
In examining the situation a little more I have come to the 
conclusion that the SASL authorization method does not fill these 
needs, because not all mechanisms can provide an authorization 
identity.  To permit authorization CAP must provide a specific 
command.

> authorization type info to the vCAR design.  I havent seen it lately so it

I think that having an authorization command would be easier
than proxy rights in the VCAR.  The VCAR can then grant rights
to the identity to which you authorized.

Alex