Subject: [kitten] [IANA #731918] SASL mechanism not listed

From: Stephen Farrell <[email-masked]>
Date: Mon, 24 Mar 2014 19:33:06 +0000

Hiya,

IANA were asked the following question a while back, but I
dropped the ball;-)

I'd appreciate your thoughts on the matter. I'm not quite
sure which registries are meant exactly though.

(I'll also forward to the oauth WG, but not cross-post)

Thanks,
S.

<start>

The following draft describes a SASL mechanism that is in use on
GMail and should not therefore be allocated to another scheme unless
we want bad things to happen.

http://tools.ietf.org/id/draft-murchison-sasl-login-00.txt

The strings XOAUTH and XOAUTH2 are also being used for a preliminary
version of the OAUTH spec as well.

The reason Google is using this particular mechanism rather than
PLAIN is that it is the one that has the widest client support:

http://www.fehcom.de/qmail/smtpauth.html

So it would be a real disaster if this particular code point was re-issued.

It would probably be a good idea if every registry had a list of 'dirty'
code points that must not be reused because there are existing applications.

<end>

---

From: Bill Mills <[email-masked]>
Date: Mon, 24 Mar 2014 13:06:53 -0700 (PDT)

Google used XOAUTH for it's original OAuth 1.0a based mechanism.  They used XOAUTH2 to specifically not conflict with whatever name we standardized on for the mechanism as standardized.

They plan, according to Ryan who's been participating on list, to implement the standardized mechanism definition under the OAUTHBEARER mechanism name so there should be no conflict.

Regards,

-bill

On Monday, March 24, 2014 12:34 PM, Stephen Farrell <[email-masked]> wrote:

See below. I think (not quite sure) that this is better
discussed on the kitten list.

Ta,
S.

-------- Original Message --------
Subject: [kitten] [IANA #731918] SASL mechanism not listed
Date: Mon, 24 Mar 2014 19:33:06 +0000
From: Stephen Farrell <[email-masked]>
To: [email-masked] <[email-masked]>
CC: [email-masked] <[email-masked]>

Hiya,

Thanks,
S.

<start>

<end>

_______________________________________________
Kitten mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/kitten

_______________________________________________
OAuth mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/oauth

---

From: Jamie Nicolson (倪志明) <[email-masked]>
Date: Tue, 25 Mar 2014 10:18:00 -0700

To be clear, Google will continue to support XOAUTH and XOAUTH2 for some
time, along with OAUTHBEARER, in order to support existing clients.

On Mon, Mar 24, 2014 at 1:06 PM, Bill Mills <[email-masked]> wrote:

> Google used XOAUTH for it's original OAuth 1.0a based mechanism.  They
> used XOAUTH2 to specifically not conflict with whatever name we
> standardized on for the mechanism as standardized.
>
> They plan, according to Ryan who's been participating on list, to
> implement the standardized mechanism definition under the OAUTHBEARER
> mechanism name so there should be no conflict.
>
> Regards,
>
> -bill
>
>