Subject: digest-md5 realm

From: Lawrence Greenfield <[email-masked]>
Date: 29 Jul 1999 17:24:37 -0400

There appears to be a conflict in draft-leach-digest-sasl-03.txt.

In Section 2.1.1, the "realm" is optional and:

  This directive is optional; if not present, the client MUST solicit
  it from the user or have been configured to use a default; a
  plausible default might be the realm supplied by the user when
  they logged in to the client system. Multiple realm directives
  are allowed.

In Section 2.1.2, the "realm" in the response is:
  The realm containing the user's account. It MUST be one of the realms
  from the "digest-challenge", if any were provided. This directive is
  required unless the server did not provide any realms; otherwise, if
  not present, or not one of the ones in the "digest-challenge",
  authentication fails.

This seems to imply that if a realm was not sent with the challenge, a
client need not reply with a realm.

I assume the realm is actually required in the response?

Thanks,
Larry

---

From: "Paul Leach (Exchange)" <[email-masked]>
Date: Thu, 29 Jul 1999 16:23:12 -0700

No realm in digest-response means to use the empty string in the calculation
of the hash.

If the server does not hold the empty string realm, then it MAY send a list
of the realms it does hold. However, the empty string realm is no different
in this respect than any other realm -- if the server does not send a list
of realms, then the client could choose a realm that the server doesn't
hold, in which case the authentication will just fail.

Paul

---

From: "Paul Leach (Exchange)" <[email-masked]>
Date: Thu, 29 Jul 1999 16:46:49 -0700

> -----Original Message-----
> From: Claus Assmann [mailto:[email-masked]]
> 
> IMHO the server could fall back to a default realm (e.g. it's FQDN)
> if no realm is sent by the client.
> 

This won't work (in general). The realm used in the hash has to be exactly
the same by the client and the server, otherwise it won't check. If the
client uses a realm value, it might as well send it.

Paul