Subject: Re: IMAP extension for SASL additional information
From: Alexey Melnikov <[email-masked]>
To: Simon Josefsson <[email-masked]>
Cc: [email-masked], [email-masked]
Date: Wed, 23 Sep 2009 21:09:39 +0100
List-Id: <ietf-imapext.imc.org>

On Wed, Sep 23, 2009 at 7:19 PM, Simon Josefsson <[email-masked]> wrote:
>
> Do IMAP support SASL authentication where the server returns additional
> information together with success?

No. The server would need to send data as a normal SASL challenge,
then the client would answer with an empty response.

> As far as I can tell from section
> 6.2.2 of RFC 3501 it does not, but I may be missing something.

From: Simon Josefsson <[email-masked]>
To: [email-masked], [email-masked]
Subject: IMAP extension for SASL additional information
OpenPGP: id=B565716F; url=http://josefsson.org/key.txt
Date: Wed, 23 Sep 2009 20:19:41 +0200
Sender: [email-masked]

Do IMAP support SASL authentication where the server returns additional
information together with success?  As far as I can tell from section
6.2.2 of RFC 3501 it does not, but I may be missing something.

Is there interest in an extension, say "SASL-AD", to provide this
capability?

It could work like this:

C: . CAPABILITY
S: * CAPABILITY SASL-AD
C: . AUTHENTICATE SCRAM-SHA-1 - SASL-AD
S: + 
C: client-first-b64-string
S: + server-first-b64-string
C: client-final-b64-string
S: . OK [SASL-AD server-final-b64-string]

When used together with SASL-IR, an exchange could look like:

C: . CAPABILITY
S: * CAPABILITY SASL-IR SASL-AD
C: . AUTHENTICATE SCRAM-SHA-1 client-first-b64-string SASL-AD
S: + server-first-b64-string
C: client-final-b64-string
S: . OK [SASL-AD server-final-b64-string]

Using "-" allows clients to avoid sending a client-first even if the
server announces support for SASL-IR, thus enabling:

C: . CAPABILITY
S: * CAPABILITY SASL-IR SASL-AD
C: . AUTHENTICATE SCRAM-SHA-1 - SASL-AD
S: + 
C: client-first-b64-string
S: + server-first-b64-string
C: client-final-b64-string
S: . OK [SASL-AD server-final-b64-string]

/Simon

Date: Wed, 23 Sep 2009 21:09:39 +0100
Subject: Re: IMAP extension for SASL additional information
From: Alexey Melnikov <[email-masked]>
To: Simon Josefsson <[email-masked]>
Cc: [email-masked], [email-masked]
Sender: [email-masked]

On Wed, Sep 23, 2009 at 7:19 PM, Simon Josefsson <[email-masked]> wrote:
>
> Do IMAP support SASL authentication where the server returns additional
> information together with success?

No. The server would need to send data as a normal SASL challenge,
then the client would answer with an empty response.

> As far as I can tell from section
> 6.2.2 of RFC 3501 it does not, but I may be missing something.

From: Simon Josefsson <[email-masked]>
To: [email-masked], [email-masked]
Subject: IMAP extension for SASL additional information
OpenPGP: id=B565716F; url=http://josefsson.org/key.txt
Date: Wed, 23 Sep 2009 20:19:41 +0200
Sender: [email-masked]

Do IMAP support SASL authentication where the server returns additional
information together with success?  As far as I can tell from section
6.2.2 of RFC 3501 it does not, but I may be missing something.

Is there interest in an extension, say "SASL-AD", to provide this
capability?

It could work like this:

C: . CAPABILITY
S: * CAPABILITY SASL-AD
C: . AUTHENTICATE SCRAM-SHA-1 - SASL-AD
S: + 
C: client-first-b64-string
S: + server-first-b64-string
C: client-final-b64-string
S: . OK [SASL-AD server-final-b64-string]

When used together with SASL-IR, an exchange could look like:

C: . CAPABILITY
S: * CAPABILITY SASL-IR SASL-AD
C: . AUTHENTICATE SCRAM-SHA-1 client-first-b64-string SASL-AD
S: + server-first-b64-string
C: client-final-b64-string
S: . OK [SASL-AD server-final-b64-string]

Using "-" allows clients to avoid sending a client-first even if the
server announces support for SASL-IR, thus enabling:

C: . CAPABILITY
S: * CAPABILITY SASL-IR SASL-AD
C: . AUTHENTICATE SCRAM-SHA-1 - SASL-AD
S: + 
C: client-first-b64-string
S: + server-first-b64-string
C: client-final-b64-string
S: . OK [SASL-AD server-final-b64-string]

/Simon