Subject: Re: [kitten] I-D Action: draft-ietf-kitten-sasl-oauth-04.txt

From: "Cantor, Scott" <[email-masked]>
Date: Wed, 22 Aug 2012 02:53:31 +0000

On 8/21/12 10:47 PM, "Nico Williams" <[email-masked]> wrote:
>
>If that's not possible then the mechanism as specified might be a SASL
>mechanism, but not a GSS nor GS2 mechanism.

There's no reason why that should be an issue here.

>It's possible to have a SASL mech that looks like a gs2 mech but
>isn't.  The question is: do you care to have OAuth as a GSS mechanism?

Well, I do. Again for the "if I get stuck with this, have it not suck"
reasoning.

-- Scott

---

From: William Mills <[email-masked]>
Date: Tue, 21 Aug 2012 22:11:59 -0700 (PDT)

OK, so to do what I want the user field needs to go back in the SASL message, and the gs2-header becomes optional and only present in a GS2 message?

>________________________________
> From: "Cantor, Scott" <[email-masked]>
>To: Nico Williams <[email-masked]> 
>Cc: William Mills <[email-masked]>; "[email-masked]" <[email-masked]>; Simon Josefsson <[email-masked]> 
>Sent: Tuesday, August 21, 2012 7:53 PM
>Subject: Re: [kitten] I-D Action: draft-ietf-kitten-sasl-oauth-04.txt
>

---

From: "Cantor, Scott" <[email-masked]>
Date: Wed, 22 Aug 2012 05:18:36 +0000

On 8/22/12 1:11 AM, "William Mills" <[email-masked]> wrote:

>OK, so to do what I want the user field needs to go back in the SASL
>message, and the gs2-header becomes optional and only present in a GS2
>message?

The latter yes, you can find boilerplate text on this in my SAML-EC mech.

I don't understand the reasoning behind specially handling the user field
and would defer to Simon on that.

-- Scott

---

From: William Mills <[email-masked]>
Date: Tue, 21 Aug 2012 22:24:39 -0700 (PDT)

We want the username passed in the SASL message somewhere.

>To: William Mills <[email-masked]>; Nico Williams <[email-masked]> 
>Cc: "[email-masked]" <[email-masked]>; Simon Josefsson <[email-masked]> 
>Sent: Tuesday, August 21, 2012 10:18 PM

---

From: Simon Josefsson <[email-masked]>
Date: Wed, 22 Aug 2012 08:34:44 +0200

I suggest using a separate field for the username hint.

/Simon

---

From: Nico Williams <[email-masked]>
Date: Wed, 22 Aug 2012 13:43:16 -0500

> There's no reason why that should be an issue here.

Right, it's very difficult to design a mechanism that could work as
SASL but never, no-how, could be adapted as a GSS mechanism.  But in
principle, if that were the case here, I'd be OK with it.

> Well, I do. Again for the "if I get stuck with this, have it not suck"

+1e6.

Nico
--

---

From: Alexey Melnikov <[email-masked]>
Date: Thu, 23 Aug 2012 10:39:56 +0100

> message, and the gs2-header becomes optional and only present in a GS2 

gs2-header is never optional on the wire.

>     ------------------------------------------------------------------------
>     *From:* "Cantor, Scott" <[email-masked]>
>     *To:* Nico Williams <[email-masked]>
>     *Cc:* William Mills <[email-masked]>; "[email-masked]"
>     <[email-masked]>; Simon Josefsson <[email-masked]>
>     *Sent:* Tuesday, August 21, 2012 7:53 PM
>     *Subject:* Re: [kitten] I-D Action:
>     draft-ietf-kitten-sasl-oauth-04.txt
>
>     On 8/21/12 10:47 PM, "Nico Williams" <[email-masked]
>     <mailto:[email-masked]>> wrote:
>     >