Subject: RE: [lemonade] URLAUTH edits to be made during AUTH48

From: "Burger, Eric" <[email-masked]>
Date: Tue, 11 Apr 2006 11:31:52 -0400

As chair: Make it So (AUTH48 edit)

-----Original Message-----
From: Alexey Melnikov [mailto:[email-masked]] 
Sent: Thursday, April 06, 2006 6:29 AM
To: Cyrus Daboo
Cc: [email-masked]; Mark Crispin
Subject: Re: [lemonade] URLAUTH edits to be made during AUTH48

Cyrus Daboo wrote:

> Hi Alexey,
>
> --On April 5, 2006 11:06:41 AM +0100 Alexey Melnikov 
> <[email-masked]> wrote:
>
>>>>>> authimapurl     = "imap://" enc-user "@" hostport "/"
imessagepart
>>>>>>                    ; replaces "imapurl" and "iserver" rules for
>>>>>> URLAUTH
>>>>>>                    ; authorized URLs
>>>>>
>>>> You should still use iuserauth above, as something like
>>>> "joe;auth=digest-md5" would be allowed here.
>>>
>>> I'm not sure that I understand.  Is ;AUTH= allowed with no userid?
>>
>> Yes. You want to prohibit it for URLAUTH URLs only.
>
> So the following would work then:
>
> authimapurl     = "imap://" enc-user [iauth] "@" hostport "/" 
> imessagepart
>                   ; replaces "imapurl" and "iserver" rules for URLAUTH
>                   ; authorized URLs

Yes, this would work.

_______________________________________________
lemonade mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/lemonade

_______________________________________________
lemonade mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/lemonade

---

From: Mark Crispin <[email-masked]>
Date: Tue, 11 Apr 2006 12:45:06 -0700 (Pacific Daylight Time)

> As chair: Make it So (AUTH48 edit)

I request a clarification.

Are you, as chair, instructing me to go ahead and make the

authimapurl     = "imap://" enc-user [iauth] "@" hostport "/" imessagepart
                   ; replaces "imapurl" and "iserver" rules for URLAUTH
                   ; authorized URLs

edit (which I had intended to do as the obvious solution before all this 
foofaraw erupted) as well as adding the requested text about how URLFETCH 
effectively executes with the access of the user who issued the 
GENURLAUTH?

Or are you just stating your opinion and putting the weight of being chair 
behind that opinion?

Put another way, shall I schedule time to work on reviewing the RFC 
Editor's work, installing the changes, and posting the diffs?  Or should I 
wait for Ted to say something?

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.
Si vis pacem, para bellum.