Subject: Re: [hybi] Proposal for extensible authentication framework

From: Iñaki Baz Castillo <[email-masked]>
Date: Wed, 14 Sep 2011 18:36:15 +0200

2011/8/13 Hannes Tschofenig <[email-masked]>:
> Take a look at
> http://tools.ietf.org/html/draft-williams-rest-gss-00
> and see whether this fits your needs of an extensible authentication framework.

Hi, sorry for so late response.

Indeed the spec you point to is interesting (but complex/long).

Anyhow, given the lack of interest about this topic in this working
group, it's better just to "ignore" all the stuf related to
authentication in WebSocket protocol. IMHO people here already has
some private/proprietary solution in mind to be used within their own
deployments (or they assume that the WebSocket server is co-located
within the Web server), so an standarized authentication mechanism is
"not needed".

> PS: OAuth is btw not protocol that authenticates the end user. Instead the handshake allows the end user to authorize the subsequent exchange of data.

Yes, sorry.

Regards.

-- 
Iñaki Baz Castillo
<[email-masked]>