Subject: New text is authentication/authorization id description (section 4.2)

From: Alexey Melnikov <[email-masked]>
Date: Mon, 01 Mar 2004 05:06:02 +0900

After the last round of discussions the section 4.2 looks like this:

4.2.  Authorization and authentication identities

SASL authentication deals with two identities: the authentication
identity, derived from the client's authentication credentials; and
the authorization identity, which is used by the server as the primary 
identity for
making access policy decisions.

The authorization identity may be an empty (zero length) string.
In this case, the server derives
an authorization identity from the client's authentication identity.

A mechanism which is incapable of transmitting an authorization identity
must be treated as if it always transmits an authorization identity of an
empty string.

Any normalization of the authentication identity is defined by a particular
SASL mechanism, the protocol profile doesn't influence it.

Any normalization of the authorization identity is defined within each
SASL protocol profile, and occurs before the authorization identity is 
handed
to the mechanism.  The mechanism may not modify (by, e.g., normalization)
the authorization identity.

Alexey