Subject: [kitten] Belated WGLC comments on draft-ietf-kitten-sasl-oauth-08.txt

From: Alexey Melnikov <[email-masked]>
Date: Mon, 05 Nov 2012 15:16:16 +0000

I think the document is in a good shape, but number of errors in 
IMAP/SMTP examples bugs me ;-).

In Section 1:

    Steps (E) and (F) are not defined in [I-D.ietf-oauth-v2] and are the
    main functionality specified within this document.  Consequently, the
    message exchange shown in Figure 2 is the result of this
    specification.  The client will genrally need to determine the

Typo: generally

2.  Terminology

    Note that the IMAP SASL specification requires base64 encoding
    message, not this memo.

Missing an Informative reference for base64. Please use "RFC 4648, 
Section 4".

In 3.1:

Use / in the ABNF (| is used by HTTP ABNF only).

RFC 2616 has to be a Normative reference (e.g. because you reference 
HTTP methods)

3.2.2.  Canonicalization

    The identity asserted by the OAuth authorization server is canonical
    for display.  The server MAY provide a different canonical form based
    on local data.

I don't understand the second sentence. SASL server? How can it do that?

In 3.3 you use "user" in your example, but it is not defined in 3.1.

In 4: "must use RFC 6125" is not detailed enough to be useful. Maybe 
point people to reuse the application protocol profile of RFC 6125 (i.e. 
in SASL OAUTH running over IMAP the IMAP profile of RFC 6125 should be 
used.)

In 5.1: the first IMAP response must start with "* OK ...".

In 5.1 SASL-IR capability is missing in the IMAP CAPABILITY response or 
the example is not valid (SASL initial response is not allowed by 
unextended IMAP).

So taking both into account:

OLD:
    S: * IMAP4rev1 Server Ready
    C: t0 CAPABILITY
    S: * CAPABILITY IMAP4rev1 AUTH=OAUTHBEARER

NEW:
    S: * OK IMAP4rev1 Server Ready
    C: t0 CAPABILITY
    S: * CAPABILITY IMAP4rev1 AUTH=OAUTHBEARER SASL-IR

In the SMTP example: the last line of EHLO response should use space 
instead of dash. The same issue in other SMTP examples.

OLD:
    S: 250-PIPELINING

NEW:
    S: 250 PIPELINING

(Also update other sections in the similar manner).

In 5.2, the first 2 lines are incorrect: no tagged response must be 
sent, you should be using OK response with CAPABILITY response code 
enclosed in []. The same issue in 5.3 and 5.4.

OLD:
   S: * CAPABILITY IMAP4rev1 AUTH=OAUTH10A-PLUS SASL-IR IMAP4rev1 Server
        Ready
   S: t0 OK Completed

NEW:
   S: * OK [CAPABILITY IMAP4rev1 AUTH=OAUTH10A-PLUS SASL-IR] IMAP4rev1 
Server Ready