Subject: sasl PLAIN and netscape communicator

From: Tony Hansen <[email-masked]>
Date: Tue, 08 Jun 1999 16:50:37 -0400

I was doing some testing of SMTP AUTH with Netscape communicator 2.6 and
it did something unexpected. The string passed in has an authorization
identity but no username. The string used for the authorization identity
is the one administered on the screen that asks for the "Outgoing mail
server user name".

Is this legit? If so, what interpretation should be given? (For now, I
added code that copies the authorization identity into the username if
the username is empty.)

	Tony Hansen
	[email-masked]

---

From: Nelson Tang <[email-masked]>
Date: Tue, 8 Jun 1999 16:41:56 -0700 (PDT)

>  Date: Tue, 08 Jun 1999 16:50:37 -0400
>  From: Tony Hansen <[email-masked]>
>  
>  The string passed in has an authorization identity but no
>  username.

It's legit.  The specification of the PLAIN SASL mechanism says:

"The client sends the authorization identity (identity to login as),
followed by a US-ASCII NUL character, followed by the authentication
identity (identity whose password will be used), followed by a US-ASCII
NUL character, followed by the clear-text password.  The client may
leave the authorization identity empty to indicate that it is the same
as the authentication identity."

[From www.ietf.org/internet-drafts/draft-newman-tls-imappop-09.txt, page
8, section 6.]

--nelson

~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~
Nelson Tang                                    [email-masked]
Internet Research Lab
UCLA Computer Science Deptartment              http://irl.cs.ucla.edu

---

From: John Gardiner Myers <[email-masked]>
Date: Tue, 08 Jun 1999 18:44:02 -0700

> It's legit.  The specification of the PLAIN SASL mechanism says:

This is legit for ANY SASL mechanism that has an authorization identity
field.  From Section 3 of RFC 2222:

	With any mechanism, transmitting an authorization identity
	of the empty string directs the server to derive an authorization
	identity from the client's authentication credentials.

---

From: Tony Hansen <[email-masked]>
Date: Tue, 08 Jun 1999 23:09:20 -0400

> as the authentication identity."

Sigh, I was getting the "authorization identity" confused with the
"authentication identity" and thinking that the latter could be left
blank to be copied from the former, whereas the spec says the opposite.

Definitely my mistake. Sorry to take up everyone's time.

	Tony Hansen
	[email-masked]

---

From: Nelson Tang <[email-masked]>
Date: Tue, 8 Jun 1999 16:41:56 -0700 (PDT)

--nelson

---

From: John Gardiner Myers <[email-masked]>
Date: Tue, 08 Jun 1999 18:44:02 -0700

---

From: Tony Hansen <[email-masked]>
Date: Tue, 08 Jun 1999 23:09:20 -0400

Tony Hansen
	[email-masked]