Subject: [xmpp] Stanza errors of type auth

From: Matthew Fulmer <[email-masked]>
Date: Wed, 10 Nov 2010 15:44:36 -0500

I'm unfamiliar with xmpp and was reading
draft-ietf-xmpp-3920bis-18 to gain familiarity with it. In
section 8.3.3, I don't feel the document adequately explains the
difference between these four error types:

8.3.3.4  forbidden
8.3.3.11 not-authorized
8.3.3.16 registration-required
8.3.3.21 subscription-required

They all seem mostly synonymous, especially the last two

-- 
Matthew Fulmer (a.k.a. Tapple)

---

From: Peter Saint-Andre <[email-masked]>
Date: Thu, 11 Nov 2010 06:09:48 +0800

> They all seem mostly synonymous, especially the last two

Thanks for the feedback. Please realize that the comment period has
closed. Based on Yaron Sheffer's security review, I will publish -19
very very soon (if we can agree on whether SASL PLAIN is
mandatory-to-implement). In his review, Yaron also mentioned that the
text in -18 did not make clear the difference between
registration-required and subscription-required, so I have added some
examples and pointers to other specs on that point. I will take another
look at all of the sections you mention to see if I can add a few
clarifying words.

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: Peter Saint-Andre <[email-masked]>
Date: Thu, 11 Nov 2010 06:29:05 +0800

> look at all of the sections you mention to see if I can add a few

In my working copy I now have:

8.3.3.4.  forbidden

   The requesting entity does not possess the necessary permissions to
   perform an action that only certain authorized roles or individuals
   are allowed to complete (i.e., it typically relates to authorization
   rather than authentication); the associated error type SHOULD be
   "auth".

8.3.3.11.  not-authorized

   The sender needs to provide credentials before being allowed to
   perform the action, or has provided improper credentials (the name
   "not-authorized", which was borrowed from the "401 Unauthorized"
   error of [HTTP], might lead the reader to think that this condition
   relates to authorization, but instead it is typically used in
   relation to authentication); the associated error type SHOULD be
   "auth".

8.3.3.16.  registration-required

   The requesting entity is not authorized to access the requested
   service because prior registration is necessary (examples of prior
   registration include members-only rooms in XMPP multi-user chat
   [XEP-0045] and gateways to non-XMPP instant messaging services, which
   traditionally required registration in order to use the gateway
   [XEP-0100]); the associated error type SHOULD be "auth".

8.3.3.21.  subscription-required

   The requesting entity is not authorized to access the requested
   service because a prior subscription is necessary (examples of prior
   subscription include authorization to receive presence information as
   defined in [XMPP-IM] and opt-in data feeds for XMPP publish-subscribe
   as defined in [XEP-0060]); the associated error type SHOULD be
   "auth".

/psa