Subject: Re: proposed CU section for CAP and UPN definition

From: Frank Dawson/CAM/Lotus <[email-masked]>
Date: Thu, 10 Jun 1999 21:06:45 GMT

Paul Hill wrote, in part:

>The optional instance name is only supported by some SASL authentication
>methods and is not widely used. The instance is normally used to designate
>a particular role or instantiation of a user. For example a UPN of the
form
>user/[email-masked] implies that the authentication will only be used
>to connect to a dial-up ISP service and will not be used for general
>service usage. A UPN of the form user/[email-masked] implies that
>example.com has decided that authentication credentials used in this case
>will only be used for CAP.

I'm having problems with these examples of "instance". How about others?

I would have thought that in the CAP specification, examples might have
been "OWNER" or "ONBEHALFOF" or "DELEGATOR" or "RESPONDEE" for cases where
the roles are that you want to authenticate with the role of the calendar
owner, your assistant, someone delegating an event or task to you or an
attendee replying to one of your invitations.

The instances of "dialup" and "cap" seem disjoint from the need for a UPN
to indicate through the SASL authentication method what calendar access
rights the CU is expecting to have.

Am I missing something?

-- Frank

---

From: "Paul B. Hill" <[email-masked]>
Date: Thu, 10 Jun 1999 17:29:48 -0400

>I'm having problems with these examples of "instance". How about others?

To be honest I don't expect anyone to use the "instance" for CAP users. 
However, a server should be able to accept it. It is used by some of the 
possible SASL mechanisms.

It becomes more important when you start talking about server to server use 
of CAP and you are using mutual authentication between the servers instead 
of user impersonation.

In this case the UPN looks more like Service/host@DNS-domain, e.g. 
CAP/[email-masked].

I put this in so that implementations wouldn't assume the simple case and 
then find that if someone plugged in another mechanism the entire system 
would break.

Paul