Subject: [NNTP] STARTTLS and authentication

From: Ken Murchison <[email-masked]>
Date: Mon, 13 Jun 2005 10:43:49 -0400

Do we want to allow a client to authenticate using STARTTLS alone (by 
presenting a client certificate), or do we always want the client to use 
AUTHINFO SASL EXTERNAL?  RFC 3501 (IMAP) has the following paragraph:

       "The server remains in the non-authenticated state, even if client
       credentials are supplied during the [TLS] negotiation.  This does
       not preclude an authentication mechanism such as EXTERNAL (defined
       in [SASL]) from using client identity determined by the [TLS]
       negotiation."

The STLS command for POP (RFC 2595) has similar text (not surprising 
since the IMAP text also came from RFC 2595).

Our current text doesn't seem to explicitly forbid a server from using 
just the client cert alone.

-- 
Kenneth Murchison     Oceana Matrix Ltd.
Software Engineer     21 Princeton Place
716-662-8973 x26      Orchard Park, NY 14127
--PGP Public Key--    http://www.oceana.com/~ken/ksm.pgp

---

From: Russ Allbery <[email-masked]>
Date: Mon, 13 Jun 2005 09:20:03 -0700

> just the client cert alone.

We should require AUTHINFO SASL EXTERNAL, just because I don't want to try
to figure out what the problems with not requiring it might be.  :)

-- 
Russ Allbery ([email-masked])             <http://www.eyrie.org/~eagle/>

---

From: Ken Murchison <[email-masked]>
Date: Mon, 13 Jun 2005 16:26:17 -0400

> to figure out what the problems with not requiring it might be.  :)

OK, I've replaced the paragraph in 2.2.2 which begins with "Generally 
and NNTP server ..."  with this:

"The server remains in the non-authenticated state, even if client
credentials are supplied during the TLS negotiation.  The AUTHINFO
SASL command [NNTP-AUTH] with the EXTERNAL mechanism [SASL] MAY be
used to authenticate once TLS client credentials are successfully
exchanged, but servers supporting the STARTTLS command are not
required to support AUTHINFO in general or that mechanism in
particular.  The server MAY use information from the client
certificate for identification of connections or posted articles
(either in its logs or directly in posted articles)."

Does this work?  If so, then we're just waiting for some feedback from Eric.

---

From: Russ Allbery <[email-masked]>
Date: Mon, 13 Jun 2005 13:26:49 -0700

> credentials are supplied during the TLS negotiation.  The AUTHINFO SASL
> command [NNTP-AUTH] with the EXTERNAL mechanism [SASL] MAY be used to
> authenticate once TLS client credentials are successfully exchanged, but
> servers supporting the STARTTLS command are not required to support
> AUTHINFO in general or that mechanism in particular.  The server MAY use
> information from the client certificate for identification of
> connections or posted articles (either in its logs or directly in posted
> articles)."

> Does this work?  If so, then we're just waiting for some feedback from

Yup, looks good to me.