Subject: SASL mechanisms that return no data in last leg

From: Luke Howard <[email-masked]>
Date: Thu, 4 Mar 2004 16:56:32 +1100

We have noticed an interoperability issue with clients that
assume that saslServerCreds will be present, but zero length,
when a SASL mechanism returns no data for the last leg of an
authentication. (An example of such a mechanism is GSSAPI.)

OpenLDAP and PADL GSS-SASL both omit saslServerCreds in this
case, whereas Active Directory returns it with a zero-length
octet. It seems to me that the Active Directory behaviour
actually makes more sense, and the OpenLDAP client (which
uses Cyrus SASL) accepts both behaviours. However, we have
noticed that some proprietary GSSAPI SASL clients fail if
saslServerCreds is not present.

See:

  http://www.openldap.org/its/index.cgi/Incoming?id=2994

RFC 2222 doesn't really distinguished between not present and
zero length; it merely says that after the server receives the
last client response the "authentication process is complete". 

-- Luke

---

From: Alexey Melnikov <[email-masked]>
Date: Sun, 07 Mar 2004 10:14:53 +0900

Luke Howard wrote:

>uses Cyrus SASL) accepts both behaviours.
>
Actually might interpretation of RFC 2222 would be exactly the opposite.
If the last leg from the server to the client doesn't send anything, 
this means there is no "additional data with success". The latter 
implies that nothing should be sent.

> However, we have
I guess the authmech document should say that clients should treat 
missing data in the last response from the server as if a zero length 
response was sent. And that for interoperability it is recommended to 
send zero length response.

Alexey

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Tue, 09 Mar 2004 16:07:05 -0800

I'd have to agree with Alexey.  The mechanism for provide data
with the last leg of the exchange is optional.  That is, if there
is data to be sent AND the server chooses not to require
another roundtrip, the server can attach the data to last
message.

Another point is that SASL allows the mechanism data
in any message of the exchange to be any octet string,
including a zero length string.  Hence, it seems that
no string and a zero length string are not necessarily
semantically equivalent here.

Kurt

At 05:14 PM 3/6/2004, Alexey Melnikov wrote:
>If the last leg from the server to the client doesn't send anything, this means there is no "additional data with success". The latter implies that nothing should be sent.
>
>>However, we have
>I guess the authmech document should say that clients should treat missing data in the last response from the server as if a zero length response was sent. And that for interoperability it is recommended to send zero length response.
>
>Alexey
>

---

From: Alexey Melnikov <[email-masked]>
Date: Wed, 10 Mar 2004 12:14:51 +0900

>semantically equivalent here.
This is correct, however LDAP is the first SASL profile I've seen that 
is able to represent them differently.
Do you think that we should say something about this in the base SASL 
document?

Alexey

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Thu, 11 Mar 2004 19:26:50 -0800

At 07:14 PM 3/9/2004, Alexey Melnikov wrote:
>This is correct, however LDAP is the first SASL profile I've seen that is able to represent them differently.
>Do you think that we should say something about this in the base SASL document?

I suggest we take this one to the SASL WG list.  I suspect they
will have to say something about this, such as they had to do
for zero-length v. absent authorization identity strings.  Once
they reach consensus as to what to say, we'll adapt as needed.

I suspect they will have to be declared equivalent and a
recommendation made that applications support one or the
other but not both.

Kurt