Subject: [http-auth] REST-GSS I-D posted

From: Nico Williams <[email-masked]>
Date: Mon, 6 Jun 2011 13:37:30 -0500

http://www.ietf.org/id/draft-williams-rest-gss-00.txt

This is to go with the slides and paper presented almost two weeks ago
at the W3C workshop on identity in the browser:

http://www.w3.org/2011/identity-ws/agenda.html

I would like to add some co-authors.  Anyone interested?

Cheers,

Nico
--

---

From: "KIHARA, Boku" <[email-masked]>
Date: Wed, 8 Jun 2011 17:59:57 +0900

Dear Nico,

I'm reading the REST-GSS I-D and have several comments on it.

> 2.9.  Server Indication of Authentication Requirement
>
>    When the server wishes to indicate that the client must authenticate
>    in order to access a given resource, then the server MUST respond to
>    the client's HTTP request with either a redirection to a web page
>    with a 303 redirect to a login page (this in the case of browser
>    applications) or a TBD 4xx error indicating that access requires
>    REST-GSS login and, optionally directing the client to the REST-GSS
>    login URI by listing that URI in a response header field named 'REST-
>    GSS-Authenticate'.
>

I'm not sure whether the 'REST-GSS-Authenticate' field is allowed for
only 4xx responses or both 303 and 4xx responses.

> 3.1. Server Decides When to Authenticate
>       C->S: HTTP/1.1 GET /some/resource
>             Host: A.example
>
>       S->C: HTTP/1.1 303 http://A.example/login.html&<encoded-URI>
>
>               Authentication required indication browser apps

Is the URI 'http://A.example/login.html&<encoded-URI>' intended for
the 'Location' field?

What is the clinging '<encoded-URI>'? If it is the REST-GSS login
URI, what is the purpose of this URI here? I think browsers cannot
(or should not) detect the REST-GSS login URI because it is merely a
part of the redirection URI, and servers do not need the '<encoded-URI>'
because they already know the REST-GSS login URI.

>       C->S: HTTP/1.1 GET /some/resource
>             Host: A.example
>
>       S->C: HTTP/1.1 4xx
>             REST-GSS-URI: http://A.example/rest-gss-login
>
>           Authentication required indication for non-browser apps

In this example, the 4xx response has the filed have a field named
'REST-GSS-URI', which is different from 'REST-GSS-Authenticate'
mentioned in 2.9. So which is correct or am I referring different
things?

Sorry for my poor English and small amount of comments, but I hope these help.

Regards,

--
KIHARA, Boku

2011/6/7 Nico Williams <[email-masked]>:
> _______________________________________________
> http-auth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/http-auth
>

---

From: Nico Williams <[email-masked]>
Date: Wed, 8 Jun 2011 10:17:06 -0500

> only 4xx responses or both 303 and 4xx responses.

Only for 4xx responses.  But I'm thinking I don't want to add any new
4xx codes, so I think we might want to do the 303 thing in all cases,
with non-browser apps having to recognize that the URI being
redirected to is the REST-GSS login URI.

> Is the URI 'http://A.example/login.html&<encoded-URI>' intended for

Ooops, yes.

> because they already know the REST-GSS login URI.

The idea was to make sure the browser could be redirected back to the
original resource when login completes.

Browsers would be redirected to a login page where there will be a
button that causes the browser to initiate and complete REST-GSS
login.  I'd like the end result to be that the user ends up on the
page that had required authentication.

> mentioned in 2.9. So which is correct or am I referring different

Ah, that's just me going too fast.  I'll fix that.  Good catch!

> Sorry for my poor English and small amount of comments, but I hope these help.

Your English is fine.  Thanks for your comments!

Nico
--