Subject: unauthenticated access without SASL layer

From: Hallvard B Furuseth <[email-masked]>
Date: Thu, 6 Nov 2003 01:45:58 +0100

Looking over the various SASL drafts, I miss one piece of functionality:
To authenticate anonymously, removing any SASL layer, but still
providing an unauthenticated ID (e.g. for logging purposes).

LDAP provides this with the 'simple' non-SASL authentication choice,
except for the part about removing the SASL layer.

The ANONYMOUS mechanism (draft-ietf-sasl-anon-02.txt) can be used for
this - except if the desired ID contains '@', which means the ID is an
e-mail address.

The PLAIN mechanism (draft-ietf-sasl-plain-03.txt) could be used if an
empty password was allowed, but it isn't.

Am I missing something?
Should one of the mechanisms above be changed to allow this?

-- 
Hallvard

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Wed, 05 Nov 2003 17:40:07 -0800

>Am I missing something?  Should one of the mechanisms above be changed to allow this?

No.  If someone really wants this, they should define a new
mechanism which allowed for an unauthenticated identity and
a layer with a null cipher.

Kurt

---

From: Alexey Melnikov <[email-masked]>
Date: Thu, 06 Nov 2003 10:58:04 +0000

>>providing an unauthenticated ID (e.g. for logging purposes).
How is this different from ANONYMOUS (except for

>a layer with a null cipher.
IMHO, there is no point in a layer with a null cipher, it just adds 
unnecessary SASL framing. Unless of course the layer does something else.

Alexey
__________________________________________
Isode Limited, http://www.isode.com

IETF standard related pages:
http://www.melnikov.ca/mel/devel/Links.html
__________________________________________

---

From: Alexey Melnikov <[email-masked]>
Date: Thu, 06 Nov 2003 11:14:18 +0000

> How is this different from ANONYMOUS (except for 

... @ sign requirement).

Alexey

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Thu, 06 Nov 2003 07:09:57 -0800

At 02:58 AM 11/6/2003, Alexey Melnikov wrote:
>IMHO, there is no point in a layer with a null cipher, it just adds unnecessary SASL framing. Unless of course the layer does something else. 

It replaces the previous layers.  Hallvard wanted a way to do that,
I assume for application protocols which only replace layers (don't
deinstall them).

This points out a serious problem with your suggestion that some
protocols can deinstall layers will others can leave them installed,
the applicability of the mechanism may be highly dependent on whether
all layers can be removed once established or not.

The more I think about adding the option to remove layers on
reauthentication, the more I think it is a bad idea.

Kurt

---

From: Hallvard B Furuseth <[email-masked]>
Date: Thu, 6 Nov 2003 16:35:54 +0100

Alexey Melnikov writes:
> How is this different from ANONYMOUS (except for @ sign requirement).

That's the difference.  If there is nothing special about the '@'
character in the underlying auth IDs, then the exclusion of names with
'@' in them is unnatural.  Though one could of course introduce a
private hack like using \ for a quote character and type @ as \40, or
something.

-- 
Hallvard

---

From: Hallvard B Furuseth <[email-masked]>
Date: Thu, 6 Nov 2003 16:37:53 +0100

> I assume for application protocols which only replace layers (don't

Yes.  It was a mistake to mention this in relation to an ANONYMOUS-like
auth, though.  It belongs in the 'selects no security layer' thread.

-- 
Hallvard

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Wed, 05 Nov 2003 17:40:07 -0800

Kurt

---

From: Alexey Melnikov <[email-masked]>
Date: Thu, 06 Nov 2003 10:58:04 +0000

Alexey

---

From: Alexey Melnikov <[email-masked]>
Date: Thu, 06 Nov 2003 11:14:18 +0000

... @ sign requirement).

Alexey

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Thu, 06 Nov 2003 07:09:57 -0800

Kurt

---

From: Hallvard B Furuseth <[email-masked]>
Date: Thu, 6 Nov 2003 16:35:54 +0100

-- 
Hallvard

---

From: Hallvard B Furuseth <[email-masked]>
Date: Thu, 6 Nov 2003 16:37:53 +0100

-- 
Hallvard