Subject: Re: [kitten] Feedback from IETF #83 on the OAUTH/SASL-KRB draft

From: Simon Josefsson <[email-masked]>
Date: Wed, 04 Apr 2012 09:53:40 +0200

William Mills <[email-masked]> writes:

> For the OAUTH mechanism a similar style signed request example is:
> GET / HTTP/1.1
> Host: server.example.com
> User: [email-masked]
> Authorization: MAC token="h480djs93hd8",timestamp="137131200",
> nonce="dj83hs9s",signature="YTVjyNSujYs1WsDurFnvFi4JK6o="
>
>
> The OAUTH mechanism will require (as currently specified) parsing of a
> Host, User, and Authorization header.

Why can't this be parsed before it is sent it over the SASL wire, and
the necessary HTTP headers reconstructed on the other side?

Is it because you want to offer compatibility with future OAuth
extensions that would send additional HTTP headers?  So by sending HTTP
headers over SASL, you will automatically support those future
extensions as well?

I can understand that reason.  Are there other reasons?

/Simon

---

From: William Mills <[email-masked]>
Date: Wed, 4 Apr 2012 07:29:27 -0700 (PDT)

Simon,

Easy extensibility for new auth profiles is the major/only reason for this.  We can achieve this another way as well, we'd have to define an extensible name/value pair mapping from HTTP data elements.  Somewhat simpler parsing, but adds a different layer of complexity.

-bill

>________________________________
> From: Simon Josefsson <[email-masked]>
>To: William Mills <[email-masked]> 
>Cc: "[email-masked]" <[email-masked]> 
>Sent: Wednesday, April 4, 2012 12:53 AM
>Subject: Re: Feedback from IETF #83 on the OAUTH/SASL-KRB draft
>