Subject: Re: [kitten] spaces in SASL user names

From: Simon Josefsson <[email-masked]>
Date: Wed, 11 Apr 2012 09:01:19 +0200

Peter Saint-Andre <[email-masked]> writes:

> At the PRECIS WG session in Paris, we had quite a discussion about
> spaces in user names. Alexey maintained that this must have been
> included in SASLprep (RFC 4013) for a good reason, but the reason
> wasn't clear to folks in the meeting. So I have a few questions:
>
> 1. Do SASL user names really need to include spaces?

I have seen real human names used for authentication identifiers more
than once, so I believe the answer is yes.

/Simon

> 2. If SASL user names do *not* need to include spaces, would it be
> fine to re-use the PRECIS NameClass for simple user names in SASL?
>
> 3. If SASL user names *do* need to include spaces, would it be fine to
> define simple user names in SASL as a space-separated list of
> NameClass entities?
>
> Option #3 seems preferable to (a) specifying that the PRECIS NameClass
> needs to include space (to which there was a lot of resistance during
> the PRECIS WG session), (b) enabling folks to superclass PRECIS string
> classes (to which there was also a lot of resistance), or (c) severely
> subclassing the PRECIS FreeClass to be something like NameClass+SP.
>
> Peter

---

From: Nico Williams <[email-masked]>
Date: Wed, 11 Apr 2012 10:48:34 -0500

One online multi-player game I play allows users to have all sorts of
strangeness in their usernames.

Nico
--

---

From: Peter Saint-Andre <[email-masked]>
Date: Wed, 11 Apr 2012 09:40:15 -0600

On 4/11/12 1:01 AM, Simon Josefsson wrote:
>> At the PRECIS WG session in Paris, we had quite a discussion
>> about spaces in user names. Alexey maintained that this must have
>> been included in SASLprep (RFC 4013) for a good reason, but the
>> reason wasn't clear to folks in the meeting. So I have a few
>> questions:
>> 
> I have seen real human names used for authentication identifiers
> more than once, so I believe the answer is yes.
> 
> /Simon

Thanks for the input. So my next question is:

>> 3. If SASL user names *do* need to include spaces, would it be
>> fine to define simple user names in SASL as a space-separated
>> list of NameClass entities?
>> 
>> Option #3 seems preferable to (a) specifying that the PRECIS
>> NameClass needs to include space (to which there was a lot of
>> resistance during the PRECIS WG session), (b) enabling folks to
>> superclass PRECIS string classes (to which there was also a lot
>> of resistance), or (c) severely subclassing the PRECIS FreeClass
>> to be something like NameClass+SP.

Feedback is welcome. :)

Peter

- -- 
Peter Saint-Andre
https://stpeter.im/

---

From: Peter Saint-Andre <[email-masked]>
Date: Wed, 11 Apr 2012 10:20:34 -0600

On 4/11/12 9:48 AM, Nico Williams wrote:
> One online multi-player game I play allows users to have all sorts
> of strangeness in their usernames.

Hi Nico,

It might be helpful to differentiate between generic "usernames" and
SASL "simple user names". SASLprep applies only to the latter.

Peter

- -- 
Peter Saint-Andre
https://stpeter.im/

---

From: Simon Josefsson <[email-masked]>
Date: Wed, 11 Apr 2012 21:20:05 +0200

>>> to be something like NameClass+SP.

I believe there is some serious terminology issue if there is resistance
to including space into a class of characters defined like this:

   NameClass:  a sequence of letters, numbers, and symbols that is used
      to identify or address a network entity such as a user account, a
      venue (e.g., a chatroom), an information source (e.g., a data
      feed), or a collection of data (e.g., a file).

Reflecting on my own usage, I have used SP in most of these types of
identifiers.  Some I use daily (user accounts and filenames).

/Simon