Subject: [kitten] spaces in SASL user names

From: Peter Saint-Andre <[email-masked]>
Date: Tue, 10 Apr 2012 15:48:21 -0600

At the PRECIS WG session in Paris, we had quite a discussion about
spaces in user names. Alexey maintained that this must have been
included in SASLprep (RFC 4013) for a good reason, but the reason
wasn't clear to folks in the meeting. So I have a few questions:

1. Do SASL user names really need to include spaces?

2. If SASL user names do *not* need to include spaces, would it be
fine to re-use the PRECIS NameClass for simple user names in SASL?

3. If SASL user names *do* need to include spaces, would it be fine to
define simple user names in SASL as a space-separated list of
NameClass entities?

Option #3 seems preferable to (a) specifying that the PRECIS NameClass
needs to include space (to which there was a lot of resistance during
the PRECIS WG session), (b) enabling folks to superclass PRECIS string
classes (to which there was also a lot of resistance), or (c) severely
subclassing the PRECIS FreeClass to be something like NameClass+SP.

Peter

- -- 
Peter Saint-Andre
https://stpeter.im/

---

From: Chris Newman <[email-masked]>
Date: Wed, 11 Apr 2012 08:48:23 -0700

--On April 10, 2012 15:48:21 -0600 Peter Saint-Andre <[email-masked]> 
wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>

Absolutely yes. My correct name is "Chris Newman" (with a space). A user 
friendly interface would use my correct name. Protocol design should never 
unnecessarily obstruct the creation of user friendly interfaces.

> define simple user names in SASL as a space-separated list of

I am opposed to changing to the SASL user name ABNF in the mechanisms, with 
RFC 4616 being the simplest example of that ABNF. Given that constraint, I 
have little opinion about how PRECIS is used. So the proposal sounds 
feasible as long as we're not making ABNF changes to the underlying 
protocol.

> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.8 (Darwin)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAk+EqqUACgkQNL8k5A2w/vzHeQCfTX6rF+MAqj05uz/ojJpPDkMT
> RaMAn2AWoWO3lRiDgxfPmDZy7B4wyawX
> =xNtO
> -----END PGP SIGNATURE-----
> _______________________________________________
> Kitten mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/kitten
>

---

From: Peter Saint-Andre <[email-masked]>
Date: Wed, 11 Apr 2012 11:52:46 -0600

On 4/11/12 9:48 AM, Chris Newman wrote:
> --On April 10, 2012 15:48:21 -0600 Peter Saint-Andre 
> <[email-masked]> wrote: At the PRECIS WG session in Paris, we
> had quite a discussion about spaces in user names. Alexey
> maintained that this must have been included in SASLprep (RFC 4013)
> for a good reason, but the reason wasn't clear to folks in the
> meeting. So I have a few questions:
> 
>> Absolutely yes. My correct name is "Chris Newman" (with a space).
>> A user friendly interface would use my correct name. Protocol
>> design should never unnecessarily obstruct the creation of user
>> friendly interfaces.
> 
> 3. If SASL user names *do* need to include spaces, would it be fine
> to define simple user names in SASL as a space-separated list of 
> NameClass entities?
> 
>> I am opposed to changing to the SASL user name ABNF in the
>> mechanisms, with RFC 4616 being the simplest example of that
>> ABNF. Given that constraint, I have little opinion about how
>> PRECIS is used. So the proposal sounds feasible as long as we're
>> not making ABNF changes to the underlying protocol.

The document that Alexey and I are working on will not override the
ABNF in any given mechanism spec (e.g., RFC 4616). However, we'll
probably want to look at how this work interacts with existing
mechanisms (e.g., would we need to update those mechanism specs to use
the PRECIS approach instead of the stringprep approach?).

Peter

- -- 
Peter Saint-Andre
https://stpeter.im/

---

From: Alexey Melnikov <[email-masked]>
Date: Sat, 14 Apr 2012 17:53:29 +0100

> the PRECIS approach instead of the stringprep approach?).
Yes. But hopefully several SASL mechanisms can be updated by a single 
document.

---

From: William Mills <[email-masked]>
Date: Mon, 16 Apr 2012 08:03:52 -0700 (PDT)

It should be noted that SMTP allows "domain specific usernames" with an extremely broad syntax that includes spaces.

>________________________________
> From: Alexey Melnikov <[email-masked]>
>To: Peter Saint-Andre <[email-masked]> 
>Cc: [email-masked] 
>Sent: Saturday, April 14, 2012 9:53 AM
>Subject: Re: [kitten] spaces in SASL user names
>

---

From: Peter Saint-Andre <[email-masked]>
Date: Tue, 17 Apr 2012 22:06:54 -0600

On 4/16/12 9:03 AM, William Mills wrote:
> It should be noted that SMTP allows "domain specific usernames"
> with an extremely broad syntax that includes spaces.

We had a long discussion during the PRECIS meeting in Paris about
spaces. I need to listen to the audio recording again before I post
further here about the reasoning, but it seems to me that the PRECIS
folks (c'est moi, among others) might want to define something like a
"compound name" that is made up of names and spaces. I'll review the
audio and pursue this matter on the PRECIS list before coming back to
the KITTEN list for further discussion.

Peter

- -- 
Peter Saint-Andre
https://stpeter.im/