Subject: Re: [#177] Realm required on challenges

From: Julian Reschke <[email-masked]>
Date: Tue, 14 Sep 2010 18:59:02 +0200

On 07.07.2009 12:47, Robert Collins wrote:
> On Tue, 2009-07-07 at 17:42 +1000, Mark Nottingham wrote:
>>
>> Not to argue a particular position WRT #177, but using NTLM is
>> probably a bad example, precisely because it does connection
>> authentication -- thereby breaking HTTP's assumption of statelessness.
>
> Oh it surely is a pain. You don't want to know how ugly making NTLM work
> through squid (to NTLM offering servers on the internet) was/is. Pretty
> hard to imagine HTTP/SMTP w/NTLM too.
>
> That said, it exists, and forcing it to add a empty realm would be
> pointless IMO - let alone probably fraught and likely to break clients.

So maybe we should be pragmatic and say:

- the realm is defined for all authentication protocols
- SHOULD be provided in the challenge
- if not provided, header should be treated as if an empty realm was 
specified

?

Best regards, Julian

---

From: Mark Nottingham <[email-masked]>
Date: Wed, 22 Sep 2010 16:01:13 +1000

On 15/09/2010, at 2:59 AM, Julian Reschke wrote:
> - if not provided, header should be treated as if an empty realm was specified

+0.5. 

I'm not thrilled about it, but unless someone wants to argue that we shouldn't impose realms on all authentication schemes...

Cheers,

--
Mark Nottingham     http://www.mnot.net/

---

From: Julian Reschke <[email-masked]>
Date: Wed, 22 Sep 2010 18:18:01 +0200

On 07.07.2009 12:47, Robert Collins wrote:
> ...
> ...

Yep. I just checked FF and IE, and they break if a realm is added for 
"ntlm".

Best regards, Julian

---

From: Julian Reschke <[email-masked]>
Date: Wed, 22 Sep 2010 18:19:26 +0200

> I'm not thrilled about it, but unless someone wants to argue that we shouldn't impose realms on all authentication schemes...

It would probably help if we had a agreement on whether we consider 
Negotiate a proper authentication scheme.

Do we ignore it, do we accept it, or do we special-case it?

Best regards, Julian