Subject: Issue 141: "should we have an auth scheme registry"

From: Julian Reschke <[email-masked]>
Date: Mon, 13 Sep 2010 18:16:16 +0200

Hi there,

this issue has been waiting for the authentication framework to become 
part of P7. Now that this has been resolved experimentally (pending IESG 
approval), we can get back to it.

Things to decide:

1) What kind of registration requirements do we want to have?

2) How do we populate the registry?

3) Which schemes do we want to populate the registry with?

Proposal:

1) Same as status codes and method names, meaning "IETF Review", as 
defined in <http://tools.ietf.org/html/rfc5226#section-4.1>:

       IETF Review - (Formerly called "IETF Consensus" in
             [IANA-CONSIDERATIONS]) New values are assigned only through
             RFCs that have been shepherded through the IESG as AD-
             Sponsored or IETF WG Documents [RFC3932] [RFC3978].  The
             intention is that the document and proposed assignment will
             be reviewed by the IESG and appropriate IETF WGs (or
             experts, if suitable working groups no longer exist) to
             ensure that the proposed assignment will not negatively
             impact interoperability or otherwise extend IETF protocols
             in an inappropriate or damaging manner.

             To ensure adequate community review, such documents are
             shepherded through the IESG as AD-sponsored (or WG)
             documents with an IETF Last Call.

             Examples: IPSECKEY Algorithm Types [RFC4025],
             Accounting-Auth-Method AVP values in DIAMETER [RFC4005], TLS
             Handshake Hello Extensions [RFC4366].

2) Same as for method names - include the registrations into a separate 
document (this avoid having a normative dependency on 2617 in Part 7).

3) Obviously "basic" and "digest". What about RFC 4559 though (register 
it, but point out the problems?)

Feedback appreciated,

Julian

---

From: Julian Reschke <[email-masked]>
Date: Wed, 15 Sep 2010 14:39:45 +0200

On 13.09.2010 18:16, Julian Reschke wrote:
> ...

Clarifying (after getting an off-list question): yes, this would allow 
Informational and Experimental RFCs (when using the IETF stream).

Best regards, Julian

---

From: Cyrus Daboo <[email-masked]>
Date: Wed, 15 Sep 2010 11:50:39 -0400

Hi Julian,

> Informational and Experimental RFCs (when using the IETF stream).

SASL has an auth scheme registry 
(<http://www.iana.org/assignments/sasl-mechanisms>). We can probably model 
ours after that (possibly adjusting if there are known problems with the 
SASL one). One thing the SASL registry has is the "Usage" column which I 
think we definitely should adopt. Also, the possibility of registering a 
"family" of schemes through use of a wildcard indicator, e.g. "GS2-*" used 
in SASL.

-- 
Cyrus Daboo

---

From: Cyrus Daboo <[email-masked]>
Date: Tue, 28 Sep 2010 11:37:30 -0400

Hi Julian,

--On September 28, 2010 5:32:28 PM +0200 Julian Reschke 
<[email-masked]> wrote:

>> (<http://www.iana.org/assignments/sasl-mechanisms>). We can probably
>> model ours after that (possibly adjusting if there are known problems
>> with the SASL one). One thing the SASL registry has is the "Usage"
>
> You mean:
>
>    Intended usage: (One of COMMON, LIMITED USE, or OBSOLETE)
>
> ? I can see that this might be useful, but in that case we should
> consider that for all of our registries...

Sure.

>> column which I think we definitely should adopt. Also, the possibility
>> of registering a "family" of schemes through use of a wildcard
>> indicator, e.g. "GS2-*" used in SASL.
>
> I'm not convinced this is needed; after all, we haven't had a registry up
> until now.
>
> SASL has a different registration requirements for single names and
> family of names; when you register a family of names you essentially
> delegate a part of the space of names to another spec -- do we really
> want that?

Take a look at <http://tools.ietf.org/id/draft-johansson-http-gss-05.txt> 
which actually tried to define an HTTP auth registry. Whilst that has 
expired, I think there still might be interest in pursuing it.

-- 
Cyrus Daboo

---

From: Julian Reschke <[email-masked]>
Date: Tue, 28 Sep 2010 18:00:26 +0200

On 28.09.2010 17:37, Cyrus Daboo wrote:
> Take a look at
> <http://tools.ietf.org/id/draft-johansson-http-gss-05.txt> which
> actually tried to define an HTTP auth registry. Whilst that has expired,
> I think there still might be interest in pursuing it.
> ...

As far as I can tell, this didn't try to define a generic registry...

Anyway: if there's a "family" of schemes, defined by the same 
specification, wouldn't it make more sense to have a single scheme name, 
and then dispatch depending on a scheme parameter instead?

So instead of

   WWW-Authenticate: FOO-BAR realm="realm"

one would use

   WWW-Authenticate: FOO realm="realm" type="BAR"

?

This would simplify the registry dramatically.

Best regards, Julian

---

From: Julian Reschke <[email-masked]>
Date: Tue, 28 Sep 2010 17:32:28 +0200

You mean:

> indicator, e.g. "GS2-*" used in SASL.

I'm not convinced this is needed; after all, we haven't had a registry 
up until now.

Best regards, Julian