Subject: [sasl] Minor change to GSS section of SCRAM (Re: [RFC State] <draft-ietf-sasl-scram-10> has changed state)

From: Nicolas Williams <[email-masked]>
Date: Fri, 22 Jan 2010 12:12:05 -0600

Sam points out that there's a tiny flaw in the GSS section of this I-D.
I wrote that the caller must use GSS_C_NO_NAME for the target principal
given that SCRAM has no target principal names.  However, SASL/GS2
callers won't know that and will try to use a host-based service
principal name.  So we should change this text to say that SCRAM
supports host-based service principal names but may ignore them.

This is a very useful change for other reasons.

Suppose a user has different SCRAM passwords for several services.  We
need a way to find the right password.  One way is to prompt.  But
another is to have a ccache-like file where we store all the passwords,
to avoid interaction:

% scraminitcreds service@host username
Password: ...
% scraminitcreds otherservice@otherhost username
Password: ...
%
% <run some SASL app>

Here it really helps to have the target principal name available as an
argument to the SCRAM GSS_Init_sec_context() function when SCRAM is used
as a GSS-API mechanism via SASL/GS2.

I intend to make this change in AUTH48.

Nico
--

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Mon, 25 Jan 2010 08:18:58 -0500

--On Friday, January 22, 2010 12:12:05 PM -0600 Nicolas Williams 
<[email-masked]> wrote:

> ...

Sounds good to me.