Subject: RE: [lemonade] Working Group Last Call on URLAUTH

From: [email-masked]
Date: Thu, 21 Oct 2004 08:22:04 -0500

> -----Original Message-----
> From: ext Mark Crispin [mailto:[email-masked]]
> Sent: Wednesday, October 20, 2004 11:42 PM
...

I think the uses cases you give make sense.

> imap://[email-masked]/INBOX/;uid=20/;section=1.2;urlauth=auth
> user:internal:91354a473744909de610943775f92038
> 

How does the resolving server distinguish between two different group accesses?

If I have orgA and orgB both gaining access to sec 1.2 and sec 1.3 respectively how does the URLFETCH processing server tell the difference?

> imap://[email-masked]/INBOX/;uid=20/;section=1.2;expire=2004-
> 10-20T20:45:00-0700;urlauth=anonymous:internal:91354a473744909
> de610943775f92038

In both user+<userid> and submit+<userid> I interpreted, based on section 2 para 6 and 7, as being the authorizing userid. I saw it as a way of tagging the Authorized URL as being from some account. Given this I would think something along the lines of anonymous+<userid> would be useful.

Mike

_______________________________________________
lemonade mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/lemonade

---

From: Mark Crispin <[email-masked]>
Date: Thu, 21 Oct 2004 08:13:10 -0700 (PDT)

On Thu, 21 Oct 2004 [email-masked] wrote:
> If I have orgA and orgB both gaining access to sec 1.2 and sec 1.3 
> respectively how does the URLFETCH processing server tell the 
> difference?

Are you asking how does the URLFETCH processing server know which 
organization is accessing the data?  It doesn't.  If you want that type of 
access control, you have to give orgA and orgB accounts on your IMAP 
server, and then use user+<userid>.

> In both user+<userid> and submit+<userid> I interpreted, based on 
> section 2 para 6 and 7, as being the authorizing userid.

No.  In the case of user+<userid>, the IMAP client must log in as that 
userid in order to do a URLFETCH with that URL.

In the case of submit+<userid> (which may be what is confusing you), the 
IMAP client must be logged in as an authorized submit server, and the 
submit server must verify that it is acting on behalf of the userid.

> I saw it as a 
> way of tagging the Authorized URL as being from some account. Given this 
> I would think something along the lines of anonymous+<userid> would be 
> useful.

The purpose of the <userid> value is not for logging.  It's for access 
control.  Anonymous, by definition, has no access control.

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.
Si vis pacem, para bellum.