Subject: Re: Replacing a SASL security layer

From: Hallvard B Furuseth <[email-masked]>
Date: Thu, 6 Nov 2003 00:46:30 +0100

Alexey Melnikov wrote:

> Ignore for a moment any relationship of realm to DIGEST-MD5,
> GSSAPI or any other SASL mechanism. Let's use the definition I
> have in the document:
>
> Conceptually, realm is the name of a collection of user's accounts.
> Realms allow the protected resources on a server to be partitioned into
> a set of protection spaces, each with its own authentication mechanisms
> and/or authorization database. For example, a proxy/frontend can use
> different realms for different servers/backends it represents.
>
> So, each "realm" ("a protection space") is served by a separate
> server (proxy example above) or a separate process/plugin
> (frontend-backend example). Does it make more sense now?

Not to me.  The client authenticates to server AA with realm A, and to
server BB with realm B.  So why does server BB see the traffic to server
AA?  Or if it doesn't, why does it know the realm A traffic, since that
belongs on server AA?  And why does the client send the same text to
server AA as to server BB, sans realm differences, so that server BB
can compare them?

-- 
Hallvard