Subject: unauthenticated access without SASL layer

From: Hallvard B Furuseth <[email-masked]>
Date: Thu, 6 Nov 2003 01:45:58 +0100

Looking over the various SASL drafts, I miss one piece of functionality:
To authenticate anonymously, removing any SASL layer, but still
providing an unauthenticated ID (e.g. for logging purposes).

LDAP provides this with the 'simple' non-SASL authentication choice,
except for the part about removing the SASL layer.

The ANONYMOUS mechanism (draft-ietf-sasl-anon-02.txt) can be used for
this - except if the desired ID contains '@', which means the ID is an
e-mail address.

The PLAIN mechanism (draft-ietf-sasl-plain-03.txt) could be used if an
empty password was allowed, but it isn't.

Am I missing something?
Should one of the mechanisms above be changed to allow this?

-- 
Hallvard