Subject: [lemonade] comments on draft-ietf-lemonade-urlauth-04.txt (fwd)

From: Mark Crispin <[email-masked]>
Date: Mon, 22 Nov 2004 14:00:34 -0800 (Pacific Standard Time)

I have received the following comments on draft 04.  Unless there is an 
objection in the next day or two, I propose to act affirmatively on all of 
these comments and produce a draft 05.

I do not think that any of these changes invalidate the WGLC on 04.  In my 
opinion, they are all minor, fall into the category of clarification, and 
will result in a superior document.

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.
Si vis pacem, para bellum.

---------- Forwarded message ----------

The examples that have wrapped lines would be easier to read if the
continued lines were indented past the leading "C: " or "S: ".  The
blurb about continuations at the start of the GENURLAUTH and URLFETCH
examples should be removed now that that is mentioned in the
'conventions' section.

Shouldn't both RESETKEY and GENURLAUTH require that the user be
able to access the mailbox named in the command or URL?  Should the
server check whether the indicated message both exists and has the
indicated part?

I think servers should be required to automatically generate a key
the first time a user uses GENURLAUTH on a mailbox.  That is, a
server MUST NOT require a client to use RESETKEY before GENURLAUTH.
RESETKEY should only be used by clients for revocation, otherwise
clients may unintentionally break each other's URLs.

The word "examine" at the end of the first paragraph of BASE.6.3.URLFETCH
should be capitalized.

The authuser/anonymous text bits look good to me, but I never really
understood why generated such a furor.

The second line of the syntax for 'access' should be indented further.

I think the syntax for mechanism is more liberal than desired: uchar
includes parens, asterisk, and URL %-escape sequences, none of which
are permitted in the IMAP atom syntax.  I suspect mechanism names
should be restricted to something like 1*(alpha / digit / safe),
though maybe they should have different syntax in URLs vs IMAP?

The IANA Considerations section needs to request registration of
URLAUTH in the imap4-capabilities registry.  There should also be
a statement somewhere that the names of URLAUTH authorization
mechanisms are case-insensitive.

_______________________________________________
lemonade mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/lemonade

---

From: Alexey Melnikov <[email-masked]>
Date: Tue, 23 Nov 2004 22:43:59 +0000

Mark Crispin wrote:

> I have received the following comments on draft 04.  Unless there is 
> an objection in the next day or two, I propose to act affirmatively on 
> all of these comments and produce a draft 05.
>
> I do not think that any of these changes invalidate the WGLC on 04.  
> In my opinion, they are all minor, fall into the category of 
> clarification, and will result in a superior document.
>
> [...]

> server check whether the indicated message both exists and has the

I've added the following text to the next revision of the RFC 2086 (ACL) 
document:

    RESETKEY - "r" right is required for each mailbox affected by the 
command.
               In particular the RESETKEY MUST NOT reset keys on 
mailboxes that
               can't be SELECT/EXAMINEd by the current user.

    GENURLAUTH - "r" right is required for each mailbox referenced in 
the URL(s)
                 specified as parameter(s) to the GENURLAUTH command.

    URLFETCH - no rights required to perform this operation.

=========
More comments: section about URLFETCH Command has the following note:

      Note: This command does not require that the URL refer to the
      selected mailbox; nor does it require that any mailbox be
      selected.  It also does not in any way interfere with any selected
      mailbox.

I think the same note should be added for the GENURLAUTH command.