Subject: Re: Expiring Passwords

From: Mark Wahl <[email-masked]>
Date: Mon, 29 Dec 1997 19:33:26 -0600

Paul Hoffman writes:

> I would tend to want to define this in SASL rather than outside for the
> simple reason that it would be easier for someone who had already
> implemented SASL to implement this extension. On the political front, it

I do not think that password changing should be part of SASL.  Some applications
which make use of the SASL framework may not have a need for password changing,
as most of the SASL mechanisms currently registered with IANA are not based on 
password negotiation.  

Besides a user changing the password for their own account, there are a number
of similar services which may found to be requirements in particular deployments
or applications.  These would include:

 - changing credentials which are not passwords
 - changing information about a user other than credentials (e.g. name)
 - allowing the support staff to change a user's credentials
 - users creating accounts for themselves (registration)

It is likely there will be devices which support SASL but do not contain any 
user account information internally.  Instead, they will rely on an external 
server which they access through LDAP, RADIUS, NIS or other appropriate protocol
to support their authentication and access control decisions.  Rather than 
require any device to be able to tunnel password changing and other account
services from their client to their authentication service, I think there would
be cleaner architecture if the client would ask the device for a "referral" to 
the set-of-URLs of the authentication service used by the device.  If there is
a protocol defined for password changing, then the server could return URLs of
this form.  

In the case of a server which maintains its own credentials database, then the
referral for a password change protocol could be to the same host as the server
itself.  This would require an additional connection setup and negotiation 
phase, but would clearly separate the use of authentication in application
protocols and the maintenance of authentication credentials, which could be 
more independent of the application protocols.

Mark Wahl, Enterprise Directory Integration
Critical Angle Inc.

---

From: Mark Wahl <[email-masked]>
Date: Mon, 29 Dec 1997 19:33:26 -0600