Subject: empty authzid in draft-ietf-sasl-plain-02.txt

From: Hallvard B Furuseth <[email-masked]>
Date: Wed, 1 Oct 2003 15:49:40 +0200

draft-ietf-sasl-plain-02.txt says that

  The client leaves
  the authorization identity empty if it wishes the server to derive the
  authorization identity from the provided authentication identity.

and

  Note that the parameters provided to the Authorize function are not
  prepared.

so I think the pseudo-code for empty authzid should say
          authzid = DeriveAuthzid(authcid);
and not
          authzid = DeriveAuthzid(pAuthcid);

-- 
Hallvard

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Wed, 08 Oct 2003 10:28:30 -0700

>          authzid = DeriveAuthzid(pAuthcid);

I think the current psuedo-code is correct, the first
quoted text is misleading.  The word "provided" should
be deleted as it implies the provided representation
(as opposed to prepared representation of the provided
authentication identity).  Also, I recommend the following
text be added immediately above the paragraph which
ends with "that string MUST be prepared before generation
of the hash."

 When the no authorization identity is provided, the server
 SHALL derive the authorization identity from the prepared
 representation of the provided authentication identity
 string.  This ensures that the derivation of different
 representations of the authentication identity produce
 the same authorization identity.

Kurt

---

From: Hallvard B Furuseth <[email-masked]>
Date: Tue, 14 Oct 2003 17:01:30 +0200

Kurt D. Zeilenga writes:
> quoted text is misleading.

I don't feel strongly about this, but the original wording seems
right to me.  authzid is not prepared, so neither does it
use the prepared version of authcid.  And that way,
PLAIN(authzid = "", authcid = X, password) does the same as
PLAIN(authzid = X,  authcid = X, password).  Your way, it does not.
That seems wrong to me.

-- 
Hallvard

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Tue, 14 Oct 2003 08:52:24 -0700

At 08:01 AM 10/14/2003, Hallvard B Furuseth wrote:

>right to me.  authzid is not prepared,

No, the psuedo-code does not prepare the authzid.  The
authzid is prepared, it's just prepared by other code.
I'll qualify the note with "by this code".

>so neither does it
>use the prepared version of authcid.

The authzid is derived from the prepared authcid to ensure
that all representations of the authentication identity
produce the same authzid.  This, I think, is important.

>And that way,
>PLAIN(authzid = X,  authcid = X, password).

These are not necessarily equivalent.  That is, authzid may
not be in the same form as the authcid and may require
different preparation.  The psuedo code (and notes) are
intended to reflect this.

Kurt

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Wed, 08 Oct 2003 10:28:30 -0700

Kurt

---

From: Hallvard B Furuseth <[email-masked]>
Date: Tue, 14 Oct 2003 17:01:30 +0200

-- 
Hallvard

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Tue, 14 Oct 2003 08:52:24 -0700

Kurt