Subject: [dix] Federated Digest Auth

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Tue, 28 Feb 2006 14:45:09 -0800

> From: Dick Hardt [mailto:[email-masked]] 

> There was an IETF BOF on Beyond Basic Auth that I had hoped 
> would develop some richer Auth mechanisms within HTTP that 
> could work with DIX.

How about Digest, it is supported inpractically every browser in use, it
is secure against man in the middle attack, it is a standard and a MUST
for HTTP/1.1

It takes practically no work to federate Digest and there is prior art
on federation in the original proposal.

If you use use the email address as the username, a common realm and SRV
records as a discovery mechanism you can implement an interoperable
federated auth scheme from existing code in a few hours.

The scheme can be made even more compact and avoid leaking the URI being
viewed by passing the HA2 value along with the federated auth request.

Its simple, secure and built on existing standards. When I discussed
this with Dan Connoly he had been thinking on very similar lines.

_______________________________________________
dix mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dix

---

From: Robert Yates <[email-masked]>
Date: Tue, 28 Feb 2006 19:50:02 -0500

>is secure against man in the middle attack, it is a standard and a MUST
+1 I would be a strong proponent of having an interop story for DIX and 
Digest.  Most feedreaders support Digest and RESTful webservices can use it.

---

From: Lisa Dusseault <[email-masked]>
Date: Tue, 28 Feb 2006 17:01:44 -0800

Speaking as an implementor (CalDAV, WebDAV), so would I (+1).

Lisa

On Feb 28, 2006, at 4:50 PM, Robert Yates wrote:

>>> There was an IETF BOF on Beyond Basic Auth that I had hoped would  
>>> develop some richer Auth mechanisms within HTTP that could work  
>>> with DIX.
>>>
>>
> +1 I would be a strong proponent of having an interop story for DIX  
> and Digest.  Most feedreaders support Digest and RESTful  
> webservices can use it.
>