Subject: SASL Realms

From: Alexey Melnikov <[email-masked]>
Date: Wed, 08 Oct 2003 23:05:14 +0100

Hallvard B Furuseth wrote:

>>   Certain SASL mechanisms, e.g. DIGEST-MD5 [SASL-DIGEST], use a concept
>>   of realm. (...)  The realm value is a case-
>>   insensitive string, generally assigned by the origin server, which
>>    
>>
> It seems to me it is not rfc2222bis' business to define realms as 
> case-insensitive. The mechanism definitions can do that. I think 
> rfc2222bis should only say that it usually is case-insensitive, or 
> maybe say that it "SHOULD" be. As it is, a mechanism can define a 
> "case- sensitive realm" if it wants to anyway, provided it confuses 
> the issue by calling it something else than a "realm".

Kurt D. Zeilenga wrote:

>>  A protocol profile SHOULD provide a guidance how realms are to be
>>  constructed and used in the protocol and MAY further restrict its
>>  syntax and protocol-specific semantics.
>>    
>>
>
>I think this SHOULD is not appropriate.  First, interoperability is
>not harmed by protocol profiles not providing such guidance.  Secondly,
>realms should be viewed as part of multi-component authentication
>identity form.  That is, in DIGEST-MD5, the authentication identity
>is composed of two parts, the user's name (username) and the user's
>realm (realm).   Having profiles overload the semantics of the
>any component of the authentication identity breaks the separation
>of mechanism and profile.
>  
>
Jeffrey Hutzelman wrote:

>>>   Certain SASL mechanisms, e.g. DIGEST-MD5 [SASL-DIGEST], use a concept
>>>   of realm.
>>
>>
>> I think it unwise to enter into a discussion of realms here.
>> Realm syntax and semantics are, for mechanisms which have realms,
>> mechanism specific.  The mechanism specification should state how
>> they are to be compared.  The mechanism specification should state
>> how they are to constructed and used in the mechanism and, where
>> appropriate, state any protocol profiling requirements.  (Note:
>> I'd likely doubt any mechanism attempt to state protocol profiling
>> requirements as this breaks SASL's separation of profile and
>> mechanism).
>
> I agree.  A realm is just part of the authentication identities used 
> by certain mechanisms.  It is mechanism-specific, and a discussion of 
> realms is irrelevant to protocol profiling.

Ok, the reason why I've added this text in the first place is because a 
lot of protocol implementors misunderstand what the realm is and is not.
Unfortunately the original text in the DIGEST-MD5 document is too vague 
to be useful. Recent discussion on LDAP mailing list proves this.
I was trying to clarify this, but your are right that the text doesn't 
belong to the base SASL specification.

I will be adding a section to DIGEST-MD5 that tries to give some 
examples of realm usage.

>>>   A protocol profile SHOULD provide a guidance how realms are to be
>>>   constructed and used in the protocol and MAY further restrict its
>>>   syntax and protocol-specific semantics.
>>
> Absolutely not.  Protocols may decide to include some concept of realm 
> in their authorization identities, but they have no business 
> whatsoever defining the semantics of authentication identities.  That 
> is the responsibility of the mechanism. 

Alexey