Subject: [Jmap] Question about authentication discovery

From: "Matt Hogan" <[email-masked]>
Date: Fri, 24 Jan 2020 07:16:31 -0600

Hi everyone,

I've been following along with the JMAP RFC for a while now, and I'm really excited about it! I have a question about authentication, specifically around how a JMAP client would know which authentication strategy to use for a given domain.

Imagine the following JMAP servers:
 * example1.com, authenticates via HTTP SCRAM (RFC 7804)
 * example2.com, authenticates via HOBA( RFC 7486)

If I want a JMAP client to work with any JMAP server, the client will need to know the form of authentication *before* it can successfully request a session. 

Are there currently any mechanisms for a client to discover this information, similar to how it can discover the URI for the session endpoint? Is the expectation that a user will have to specify to the client the authentication method and authentication URI?

-- Matt