Subject: Proposed MANAGESIEVE changes

From: Ken Murchison <[email-masked]>
Date: Tue, 01 Apr 2003 14:35:03 -0500

Here are the proposed changes to MANAGESIEVE that I mentioned at IETF. 
These have been sent to and accepted by Tim Martin already:

1. Based on the fact that the server no longer auto-issues the
capabilities response (per draft -04), paragraph 3 of section 2.2 should
be changed to something like (stolen from RFC 2595):

      Once TLS has been started, the client MUST discard cached
      information about server capabilities and SHOULD re-issue the
      CAPABILITY command.  This is necessary to protect against
      man-in-the-middle attacks which alter the capabilities list prior
      to STARTTLS.  The server MAY advertise different capabilities
      after STARTTLS.

2. Based on Cyrus Murder/virtdomains work, Rob Siemborski and I propose
the following augmented Sieve URL grammar:

sieveurl = "sieve://" [ [ authinfo "@" ] hostport ] "/" scriptname

authinfo = authid [ ";" userid ]

authid = userid = *( unreserved | escaped | 
                     ":" | "&" | "=" | "+" | "$" | "," )

scriptname = *pchar

-- 
Kenneth Murchison     Oceana Matrix Ltd.
Software Engineer     21 Princeton Place
716-662-8973 x26      Orchard Park, NY 14127
--PGP Public Key--    http://www.oceana.com/~ken/ksm.pgp

---

From: Chris Newman <[email-masked]>
Date: Fri, 04 Apr 2003 20:04:37 -0800

> authid = userid = *( unreserved | escaped |

Please try to keep the authinfo syntax compatible with RFC 2192 authinfo.

I suggest instead:

authinfo = userid [ ";AUTHID=" authid ]

                - Chris

---

From: Ken Murchison <[email-masked]>
Date: Sat, 05 Apr 2003 08:40:23 -0500

> authinfo = userid [ ";AUTHID=" authid ]

Sure.  No complaints here.

---

From: Marc Mutz <[email-masked]>
Date: Sat, 5 Apr 2003 17:39:40 +0200

On Saturday 05 April 2003 15:40, Ken Murchison wrote:
<snip>
> Sure.  No complaints here.
<snip>

Please follow rfc2192, rfc2384 and probably others that have something 
like

authinfo = userid [ ";AUTH=" authid ]
authid = "*" / sasl-authid
sasl-authid = any mechanism identifier registered for SASL

(the point is about AUTH vs. AUTHID).

Marc

-- 
Ich gegen meinen Bruder.
Ich und mein Bruder gegen unseren Cousin.
Ich, mein Bruder und unser Cousin gegen unsere Nachbarn.
Wir alle gegen den Fremden.
                                      -- Beduinen-Sprichwort

---

From: Ken Murchison <[email-masked]>
Date: Sun, 06 Apr 2003 09:42:31 -0400

> (the point is about AUTH vs. AUTHID).

No, we _want_ AUTHID.  AUTHID is the authentication identifier, NOT and
authentication mechanism name.

---

From: Marc Mutz <[email-masked]>
Date: Mon, 7 Apr 2003 16:23:57 +0200

On Sunday 06 April 2003 15:42, Ken Murchison wrote:
<snip>
> No, we _want_ AUTHID.  AUTHID is the authentication identifier, NOT
> and authentication mechanism name.
<snip>

You mean authid like in what some sasl mechnisms support beside the 
userid? Hmm, is there another URL scheme that uses ;AUTHID= for that?

In any case, I think ;AUTH= should be added, too, since it's quite 
standard in URL schemes in the IMAP/mail realm: ACAP, IMAP, POP3 all 
use it. Having both will also point out that they're describing 
different things.

Marc

-- 
We notice things that don't work. We don't notice things that do.
We notice computers, we don't notice pennies.
We notice e-book readers, we don't notice books.
                                          -- Douglas Adams