Subject: Section 3.2 in 2222bis

From: Simon Josefsson <[email-masked]>
Date: Tue, 09 Nov 2004 23:01:50 +0100

Hello.  One idea for section 3.2.

OLD:

   SASL mechanism specifications describe the form of credentials
   used to authenticate clients, and SASL application
   profiles describe the form of authorization identities
   transferred as part of authentication exchange.
   However, the
   precise form(s) of the authentication identities (used
   within the server in its verifications, or otherwise)
   and the precise form(s) of the authorization identities
   (used in making authorization decisions, or otherwise) is
   beyond the scope of the SASL and this specification.  In
   some circumstances, the precise identity forms used
   outside of the SASL exchange may be dictated by other
   specifications.  For instance, the authorization policy
   specification for an application protocol may dictate the
   precise form that an authorization identity is to be
   represented in the authorization policy.

   <<Need to address few issues in the two remaining paragraphs>>
   Any normalization of the authentication identity (for the purposes
   of conducting authentication exchange) is defined by a particular
   SASL mechanism, the protocol profile doesn't influence it.
   Note, that the mechanism specification doesn't control how
   authentication identity information is represented elsewhere
   <<need to add few examples>>.

   The mechanism MUST preserve Unicode codepoints when transferring
   authorization identity (e.g. the mechanism can't apply any form
   of normalization).

NEW:

   SASL mechanism specifications describe the credentials used to
   authenticate clients.  SASL application profiles describe the
   authorization identities transferred as part of authentication
   exchange.

   The authentication and authorization identities are assumed to be
   arrays of Unicode code points.

   The mechanism MUST preserve Unicode code points when transferring
   the authorization identity.  Specifically, the mechanism cannot
   apply any form of normalization on authorization identities.  The
   mechanism MAY normalize the authentication identity before or after
   sending it from the client to the server.

   The application profile MUST NOT place any requirements on the
   authentication identity that is to be transfered by the mechanism.
   Specifically, the application profile cannot apply any form of
   normalization to the authentication identity.  The application
   profile MAY normalize the authorization identity before or after
   sending it from the client to the server.

   The encoding (e.g., UTF-8 or UCS-4) of the authentication identity
   (used within the server in its verifications, or otherwise) and the
   encoding of the authorization identity (used in making
   authorization decisions, or otherwise) is beyond the scope of the
   SASL and this specification.  In some circumstances, the encodings
   used may be dictated by other specifications.  For instance, the
   authorization policy specification for an application protocol may
   dictate that a specific encoding of the authorization identity is
   used.

Thanks.