Subject: RE: Authentication in existing WebDAV servers

From: "Yaron Goland (Exchange)" <[email-masked]>
Date: Tue, 2 Nov 1999 11:51:24 -0800

Yes the spec absolutely bans the use of basic over an unsecure connection.
Frankly I hate language like this. If people want to do really stupid things
that don't effect interoperability then that should be their business.

However it was made clear to us that the absence of the previous language
would cause problems in our standardization.

So the language is in the spec.

Personally I like requiring that everyone support Digest. This is important
for interoperability. You have to have some minimum guaranteed level of
security interoperability. However beyond that I think people should be
allowed to be as stupid as they want. If they want to send Basic in the
clear, if they want to avoid using authentication at all, that is their
business.

So long as people who do want to do the right thing can do the right thing
then I'm happy.

		Yaron

> -----Original Message-----
> From: Greg Stein [mailto:[email-masked]]
> Sent: Monday, November 01, 1999 11:47 PM
> To: Yaron Goland (Exchange)
> Cc: Richard C.; 'WebDAV'
> Subject: RE: Authentication in existing WebDAV servers
> 
> 
> All right... true... the spec is a bit different than I 
> implied. Section
> 17.1 spells it out. Yes, it must be supported (as opposed to always
> required), and yes, you can use anything you want... *IF* you 
> use a secure
> channel.
> 
> Over plain old HTTP, the spec does state that Basic must not be used.
> 
> Yes, I'm being picky here, but you were first :-)
> 
> Cheers,
> -g
> 
> On Mon, 1 Nov 1999, Yaron Goland (Exchange) wrote:
> > The spec says that digest MUST be supported. You can use 
> anything you want,
> > including nothing.
> > 
> > > -----Original Message-----
> > > From: Greg Stein [mailto:[email-masked]]
> >...
> > > The WebDAV spec states that Digest authentication must be used.
> > > 
> > > However, all clients and servers, that I'm aware of, are 
> > > flexible in this
> > > regard. For example, Apache and mod_dav will allow the 
> use of Basic
> > > authentication.
> 
> --
> Greg Stein, http://www.lyra.org/
>

---

From: "Larry Masinter" <[email-masked]>
Date: Tue, 2 Nov 1999 21:21:43 PST

> Personally I like requiring that everyone support Digest.
> This is important for interoperability. You have to have some
>  minimum guaranteed level of security interoperability.
> However beyond that I think people should be allowed to be
> as stupid as they want. If they want to send Basic in the clear,
> if they want to avoid using authentication at all, that is their
> business.
>
> So long as people who do want to do the right thing can do the
> right thing then I'm happy. 
 
The question is whether what's in the spec is actually strong
enough to insure interoperability. In integrating network systems
with WebDAV,  seems that there is no guaranteed authentication
mechanism that you can be insured of supplying credentials to
that will work with most servers, even for servers that are
technically compliant with the spec. 

Right now, it says 
"WebDAV applications MUST support the Digest authentication scheme
   [RFC2069]."

But servers might "implement" digest, not allow digest authentication
for access rights to any of the server's collections.

Secondly, "Digest authentication" is itself may not be specific
enough; do you want to specify a minimum algorithm & qop value?

We've been having some difficulties finding interoperable
authentication mechanisms for non-browser-based WebDAV use.

There's no law that says "you must implement WebdAV", so people
can always implement whatever they want, and do! The question is
whether compliance guarantees interoperability. Right now,
it doesn't seem like it does, and the spec might need to change.

Larry
-- 
http://www.parc.xerox.com/masinter

---

From: Jim Whitehead <[email-masked]>
Date: Wed, 3 Nov 1999 21:55:54 -0800

> for access rights to any of the server's collections.

It seems to me that since HTTP authentication is challenge-response, a
client that implements Basic and Digest Auth should be able to interoperate
against all HTTP/DAV servers.  In HTTP/DAV, a client issues its request,
receives back a challenge which specifies the kinds of authentication that
can be used to satisfy the challenge, and in response the client reissues
the request with the authentication credentials.  If a server doesn't
implement Digest, but does implement Basic, and sends a challenge asking for
Basic, if the client implements Basic, it will be able to respond to the
challenge.  So, there is interoperability here, just not interoperability at
the Digest Auth level. If the client must have Digest level auth., and only
receives a Basic challenge, then it could abort the request and pop up a
dialog explaining the problem (good luck making this meaningful to users,
though :-).

> enough; do you want to specify a minimum algorithm & qop value?

Well, since the only algorithm specified in RFC 2617 is MD5, and I know of
no other fielded Digest algorithms, specifying the Digest algorithm seems a
bit of an overkill.  But, it's undoubtedly prudent, and could certainly lead
to less ambiguity in the future.  As for qop value, this doesn't seem like
something we should specify, since it appears to describe a per-message
characteristic, and the DAV spec. cannot guarantee what the per-message
security characteristics may be.

> authentication mechanisms for non-browser-based WebDAV use.

Hearing this I have two questions:
a) what do you mean by "interoperable" in this case -- I'm genuinely
unclear.
b) could you give an example of the problems you're encountering?

> Right now,

Certainly this is an area which hasn't been extensively interoperability
tested, so it's possible there could be problems.  On the other hand, I've
heard no concrete problems yet.

- Jim