Subject: CAP definition of Identify command

From: Alexander Taler <[email-masked]>
Date: Fri, 11 Jun 1999 17:49:13 -0400

Here's a write up of the Identify command for the CAP
draft.

7.1.7 IDENTIFY Command

Arguments:   Identity to assume

Data:        None

Result:      2.0
             6.3  Identity not authorized

The "IDENTIFY" command allows the CUA to select a new
identity to be used for calendar access.  This command may
only be called in the Authenticated State.

The CS determines through an internal mechanism if the
credentials supplied at authentication permit the assumption
of the selected the identity.  If they do the session
assumes the new identity, otherwise the security error 6.3
is returned.

---

From: Frank Dawson/CAM/Lotus <[email-masked]>
Date: Sun, 13 Jun 1999 20:01:21 GMT

And if the selected "identity" is not supported, then what state is the CAP
session left in?
Unless the CAP session is returned to unauthenticated, then it would appear
that this function can facilitate being used to threat a CAP server.

Any result other than "2.0, SUCCESS" with the IDENTITY function should
result in CAP session being reset to the CONNECTED, but unauthenticated
state. This will force a CAP user threatening the CAP server to
reauthenticate and may assist in identifying and logging threats to the CAP
server.

-- Frank Dawson