Subject: Cyrus SASL 1.5.0 released

From: Lawrence Greenfield <[email-masked]>
Date: 22 Jun 1999 22:59:54 -0400

I'm pleased to announce the release of Cyrus SASL, version 1.5.0,
available at:
<url:ftp://ftp.andrew.cmu.edu/pub/cyrus-mail/cyrus-sasl-v1.5.0.tar.gz>

It is a fully functional implementation of Chris Newman's SASL API,
allowing clients and servers to easily support many authentication
methods.  We plan on using it for all authentication in the next
release of Cyrus IMAPD, coming soon.

Please try it out.  Send comments to <[email-masked]>.

This version includes the following plugins:
ANONYMOUS
CRAM-MD5
DIGEST-MD5
GSSAPI
KERBEROS_V4
PLAIN

Thanks,
Larry Greenfield
[email-masked]

Date: 22 Jun 1999 22:59:54 -0400
From: Lawrence Greenfield <[email-masked]>
To: [email-masked]
Subject: Cyrus SASL 1.5.0 released
Sender: [email-masked]

I'm pleased to announce the release of Cyrus SASL, version 1.5.0,
available at:
<url:ftp://ftp.andrew.cmu.edu/pub/cyrus-mail/cyrus-sasl-v1.5.0.tar.gz>

It is a fully functional implementation of Chris Newman's SASL API,
allowing clients and servers to easily support many authentication
methods.  We plan on using it for all authentication in the next
release of Cyrus IMAPD, coming soon.

Please try it out.  Send comments to <[email-masked]>.

This version includes the following plugins:
ANONYMOUS
CRAM-MD5
DIGEST-MD5
GSSAPI
KERBEROS_V4
PLAIN

Thanks,
Larry Greenfield
[email-masked]

Date: Tue, 08 Jun 1999 23:09:20 -0400
From: Tony Hansen <[email-masked]>
Organization: AT&T Laboratories
To: Nelson Tang <[email-masked]>
CC: [email-masked]
Subject: Re: sasl PLAIN and netscape communicator
Sender: [email-masked]

Nelson Tang wrote:
> 
> >  The string passed in has an authorization identity but no
> >  username.
> 
> It's legit.  The specification of the PLAIN SASL mechanism says:
> 
> "The client sends the authorization identity (identity to login as),
> followed by a US-ASCII NUL character, followed by the authentication
> identity (identity whose password will be used), followed by a US-ASCII
> NUL character, followed by the clear-text password.  The client may
> leave the authorization identity empty to indicate that it is the same
> as the authentication identity."

Sigh, I was getting the "authorization identity" confused with the
"authentication identity" and thinking that the latter could be left
blank to be copied from the former, whereas the spec says the opposite.

Definitely my mistake. Sorry to take up everyone's time.

	Tony Hansen
	[email-masked]

To: [email-masked]
Path: not-for-mail
From: John Gardiner Myers <[email-masked]>
Newsgroups: mcom.list.ietf-sasl
Subject: Re: sasl PLAIN and netscape communicator
Date: Tue, 08 Jun 1999 18:44:02 -0700
Organization: Netscape Communications Corporation
Lines: 11
NNTP-Posting-Host: 208.12.60.63
Sender: [email-masked]

Nelson Tang wrote:
> It's legit.  The specification of the PLAIN SASL mechanism says:

This is legit for ANY SASL mechanism that has an authorization identity
field.  From Section 3 of RFC 2222:

	With any mechanism, transmitting an authorization identity
	of the empty string directs the server to derive an authorization
	identity from the client's authentication credentials.

Date: Tue, 8 Jun 1999 16:41:56 -0700 (PDT)
From: Nelson Tang <[email-masked]>
To: [email-masked]
CC: [email-masked]
Subject: Re: sasl PLAIN and netscape communicator
Sender: [email-masked]

>  Date: Tue, 08 Jun 1999 16:50:37 -0400
>  From: Tony Hansen <[email-masked]>
>  
>  The string passed in has an authorization identity but no
>  username.

It's legit.  The specification of the PLAIN SASL mechanism says:

"The client sends the authorization identity (identity to login as),
followed by a US-ASCII NUL character, followed by the authentication
identity (identity whose password will be used), followed by a US-ASCII
NUL character, followed by the clear-text password.  The client may
leave the authorization identity empty to indicate that it is the same
as the authentication identity."

[From www.ietf.org/internet-drafts/draft-newman-tls-imappop-09.txt, page
8, section 6.]

--nelson

~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~
Nelson Tang                                    [email-masked]
Internet Research Lab
UCLA Computer Science Deptartment              http://irl.cs.ucla.edu

Date: Tue, 08 Jun 1999 16:50:37 -0400
From: Tony Hansen <[email-masked]>
Reply-To: [email-masked]
Organization: AT&T Laboratories
To: [email-masked]
Subject: sasl PLAIN and netscape communicator
Sender: [email-masked]

I was doing some testing of SMTP AUTH with Netscape communicator 2.6 and
it did something unexpected. The string passed in has an authorization
identity but no username. The string used for the authorization identity
is the one administered on the screen that asks for the "Outgoing mail
server user name".

Is this legit? If so, what interpretation should be given? (For now, I
added code that copies the authorization identity into the username if
the username is empty.)

	Tony Hansen
	[email-masked]