Subject: [lemonade] URLAUTH edits to be made during AUTH48

From: Mark Crispin <[email-masked]>
Date: Tue, 4 Apr 2006 13:34:56 -0700 (PDT)

Here's the set of edits that I propose to make during AUTH48 for URLAUTH. 
Note that this is strictly for bug fixes.

73c73
<    that it only supports authentication, and confuses the concepts
---
>    that it only supports authentication, and confuses the concepts of
78c78
<    conveys authorization in the URL name itself, and reuses a portion of
---
>    conveys authorization in the URL string itself, and reuses a portion of
195c195
<    [IMAPURL] is extended by allowing the addition of ;EXPIRE=<datetime>"
---
>    [IMAPURL] is extended by allowing the addition of ";EXPIRE=<datetime>"
416,417c416,417
<           As a consequence, the iserver rule of [IMAPURL] is modified
<           so that iuserauth is mandatory.
---
>           As a consequence, relative URLs are not permitted, and
>           enc-user is mandatory, in URLAUTH authorized URLs.
424,425c424,425
<       (4) the server MAY also verify that the Message-ID and/or
<           second components (if present) are valid.
---
>       (4) the server MAY also verify that the iuid and/or isection
>           components (if present) are valid.
626c626,628
< authimapurl     = "imap://" iuserauth "@" hostport "/" imessagepart
---
> authimapurl     = "imap://" enc-user "@" hostport "/" imessagepart
>                    ; replaces "imapurl" and "iserver" rules for URLAUTH
>                    ; authorized URLs
633a636,638
> enc-user        = 1*achar
>                    ; same as "enc_user" in RFC 2192
> 
638c643
< access          = ("submit+" iuserauth) / ("user+" iuserauth) /
---
> access          = ("submit+" enc-user) / ("user+" enc-user) /
719,720c724
<               Specifications: ABNF", draft-crocker-abnf-rfc2234bis (work
<               in progress).
---
>               Specifications: ABNF", RFC 4234, October 2005.
723c727
<               draft-newman-lemonade-burl (work in progress).
---
>               draft-ietf-lemonade-burl (work in progress).

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.
Si vis pacem, para bellum.

_______________________________________________
lemonade mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/lemonade

---

From: Alexey Melnikov <[email-masked]>
Date: Tue, 04 Apr 2006 21:43:23 +0100

>>                    ; replaces "imapurl" and "iserver" rules for URLAUTH
You should still use iuserauth above, as something like 
"joe;auth=digest-md5" would be allowed here.

The rest of your diff looks fine to me.

---

From: Mark Crispin <[email-masked]>
Date: Tue, 4 Apr 2006 13:50:13 -0700 (Pacific Daylight Time)

On Tue, 4 Apr 2006, Alexey Melnikov wrote:
> You should still use iuserauth above, as something like "joe;auth=digest-md5" 
> would be allowed here.

Allowed in IMAPURLs?

Then it looks like I need to redefine iuserauth...

-- Mark --

---

From: Mark Crispin <[email-masked]>
Date: Tue, 4 Apr 2006 16:33:19 -0700 (Pacific Daylight Time)

> You should still use iuserauth above, as something like "joe;auth=digest-md5" 

I'm not sure that I understand.  Is ;AUTH= allowed with no userid?

By the way, I just got the AUTH48.

-- Mark --

---

From: Alexey Melnikov <[email-masked]>
Date: Wed, 05 Apr 2006 11:06:41 +0100

> I'm not sure that I understand.  Is ;AUTH= allowed with no userid?

Yes. You want to prohibit it for URLAUTH URLs only.

---

From: Alexey Melnikov <[email-masked]>
Date: Wed, 05 Apr 2006 11:07:47 +0100

>> "joe;auth=digest-md5" would be allowed here.

Yes.

> Then it looks like I need to redefine iuserauth...

I guess you should. I will rewrite the whole ABNF in 2192bis.

---

From: Cyrus Daboo <[email-masked]>
Date: Wed, 05 Apr 2006 19:33:25 -0400

Hi Alexey,

> Yes. You want to prohibit it for URLAUTH URLs only.

So the following would work then:

authimapurl     = "imap://" enc-user [iauth] "@" hostport "/" imessagepart
                   ; replaces "imapurl" and "iserver" rules for URLAUTH
                   ; authorized URLs

-- 
Cyrus Daboo

---

From: Alexey Melnikov <[email-masked]>
Date: Thu, 06 Apr 2006 11:29:27 +0100

>                   ; replaces "imapurl" and "iserver" rules for URLAUTH

Yes, this would work.