From nobody Mon Aug 14 09:19:40 2017 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4C7A112426E for ; Mon, 14 Aug 2017 09:19:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.621 X-Spam-Level: X-Spam-Status: No, score=-2.621 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NXP4qDJqJCro for ; Mon, 14 Aug 2017 09:19:37 -0700 (PDT) Received: from lb1-smtp-cloud9.xs4all.net (lb1-smtp-cloud9.xs4all.net [194.109.24.22]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id ABF24124207 for ; Mon, 14 Aug 2017 09:19:35 -0700 (PDT) Received: from airhead.local ([IPv6:2001:980:93a5:1:681e:d64c:e91a:ef73]) by smtp-cloud9.xs4all.net with ESMTPSA id hI5UdYaB8dRLjhI5VdPH5R; Mon, 14 Aug 2017 18:19:34 +0200 Message-ID: <5991CD93.5090203@openfortress.nl> Date: Mon, 14 Aug 2017 18:19:31 +0200 From: Rick van Rein User-Agent: Postbox 3.0.11 (Macintosh/20140602) MIME-Version: 1.0 To: http-auth@ietf.org References: <586A3C94.4090504@openfortress.nl> In-Reply-To: <586A3C94.4090504@openfortress.nl> X-Enigmail-Version: 1.2.3 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-CMAE-Envelope: MS4wfO9s36AcWZvo35i0w4yYYK180MwjMsBjFGHcyCiICTlS0Z9nFytVmMxohBQZWLZfwh+a5W/DSJrt2YhTwd0+IiFaTlGhQqcd7tKz4FlMCDNap0M3BAiR JHWLwcxRlbypZ7UoQb+wCUvptReg8OoxIW0WmEZrN5quTZoMYfTFs3Fi3g7LlqZO0OLVQPeYRluOGrPkJQsRHXvHwEXkeQEiOuNyMV3ScGpXCgemp3wmxv5A Azf+/9yMJB7FsPNrjutH8C+jpv1bzFAp82hUI3xm7kM= Archived-At: Subject: Re: [http-auth] Why is there no SASL support in HTTP? X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 Aug 2017 16:19:39 -0000 Hello former WG, In Januari I wrote... > I've been wondering why HTTP Authentication does not support SASL, but > instead chooses independent mechanisms from SASL? ...and given the positive replies back then, I have now written a draft to cover this idea. https://datatracker.ietf.org/doc/draft-vanrein-httpauth-sasl/ Related to this is a proposal that can be helpful to pass SASL over EAP to (shared) backend infrastructure, https://datatracker.ietf.org/doc/draft-vanrein-eap-sasl/ It includes channel binding, which AFAIK is new to HTTP, but SASL is clear about how to do this: skip over the application protocol and incorporate TLS through tls-unique, as a minimum mechanism. So the reasoning for SCRAM-* to not support it because HTTP does not define it, does not seem to apply here. I hope I'm not poking in a hornet's nest by saying this... Given that the HTTPAUTH WG has been dismantled, I am not sure what to do next. Any advise is welcome. Best wishes, Rick van Rein InternetWide.org / ARPA2.net / OpenFortress.nl From nobody Mon Aug 14 10:52:15 2017 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8505C1323B6 for ; Mon, 14 Aug 2017 10:52:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XxqJIJ3fbaS9 for ; Mon, 14 Aug 2017 10:52:12 -0700 (PDT) Received: from mail-wm0-x243.google.com (mail-wm0-x243.google.com [IPv6:2a00:1450:400c:c09::243]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1C6F01323C4 for ; Mon, 14 Aug 2017 10:52:12 -0700 (PDT) Received: by mail-wm0-x243.google.com with SMTP id q189so15320263wmd.0 for ; Mon, 14 Aug 2017 10:52:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=3mgE5pEhWkS6jGcYkWTXCtDZZDZ5UpU8GxaKtoY/OMM=; b=lkdWCONWUMP6rqsNcYQapLe9AQ3BjHiCR6no7fQafYzw0z1uBbTwrxkmn6kk4iUbcS 98wclHSdRAIduoMoUrc+pOb2QlRL0+gRYHfD/98IfhqzDZY52OH33dp61W94FyvFYIWZ 4m6BkHj6mHb7Li4Ev42gukh2WwuXWuY49rHC92Qc6Pk6hqjkw/fqTmMdNYW+/cj1OzUA tHweSjBtmXOFj/auORlA9FuljJOQpb7gm5l9HiahhXvzDG1ld7Fx2JbPofNh+EW5eB+2 IMirP28SeOJNoTrI085yEGK4Ra+lcGwJJxGRBqGUX/YSpfYv7c4h0U3UoBkLvqxETSm1 7Beg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=3mgE5pEhWkS6jGcYkWTXCtDZZDZ5UpU8GxaKtoY/OMM=; b=nnsAt7NVYoT1AEm4UZVKoTd88++ZfkCXhor1nHi2jdYOYegK53tveQqnk/TO0EZDDx 9RRsrVk6KhqmjtmkNT8fTVkjO0Bh1KZ/Ml9ojTGtDYiT4t8Jo9Dcpv93of+LNsnrtL94 HDPSfL4PrVW1v4IwzlZb4810WCZVALwceog/hJ0rh2ptGOGKQbXxQaHW6Vukjaht3Y7s tguEq8TY5e4DOw0rtRtHY7zmmkKNQrjZfk/85U3o2uf/EeKR4cw58WoLJAfMhixEi1FU Okfj2GsM2t+aHnPmhI9pvgUZ1+X8dm31y88HIPxId4+3AMw1pzWxb4c+C9qFB5y3gYic vtGw== X-Gm-Message-State: AHYfb5hVz273VKJmRn9b0M2Rk97Rpmy0Yubf1qJ6LAXxFnKRXenbHnAC sodigUSmSRBTow== X-Received: by 10.80.147.134 with SMTP id o6mr26180496eda.102.1502733130599; Mon, 14 Aug 2017 10:52:10 -0700 (PDT) Received: from [192.168.1.18] ([46.120.57.147]) by smtp.gmail.com with ESMTPSA id x35sm4395353edx.5.2017.08.14.10.52.09 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 14 Aug 2017 10:52:09 -0700 (PDT) From: Yoav Nir Message-Id: <98D653C8-06F9-4BA2-B086-B748325D13D1@gmail.com> Content-Type: multipart/signed; boundary="Apple-Mail=_160FB130-7BC1-4BC5-B6B2-19885DE86549"; protocol="application/pgp-signature"; micalg=pgp-sha512 Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) Date: Mon, 14 Aug 2017 20:52:07 +0300 In-Reply-To: <5991CD93.5090203@openfortress.nl> Cc: http-auth@ietf.org To: Rick van Rein References: <586A3C94.4090504@openfortress.nl> <5991CD93.5090203@openfortress.nl> X-Mailer: Apple Mail (2.3273) Archived-At: Subject: Re: [http-auth] Why is there no SASL support in HTTP? X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 Aug 2017 17:52:14 -0000 --Apple-Mail=_160FB130-7BC1-4BC5-B6B2-19885DE86549 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Hi, Rick. Since this is security-related and does not naturally belong to any = existing working group, the way to go is to send a message to the SAAG = list (security area advisory group) and see if it generates interest = there. Yoav > On 14 Aug 2017, at 19:19, Rick van Rein wrote: >=20 > Hello former WG, >=20 > In Januari I wrote... >=20 >> I've been wondering why HTTP Authentication does not support SASL, = but >> instead chooses independent mechanisms from SASL? >=20 > ...and given the positive replies back then, I have now written a = draft > to cover this idea. >=20 > https://datatracker.ietf.org/doc/draft-vanrein-httpauth-sasl/ >=20 > Related to this is a proposal that can be helpful to pass SASL over = EAP > to (shared) backend infrastructure, >=20 > https://datatracker.ietf.org/doc/draft-vanrein-eap-sasl/ >=20 >=20 > It includes channel binding, which AFAIK is new to HTTP, but SASL is > clear about how to do this: skip over the application protocol and > incorporate TLS through tls-unique, as a minimum mechanism. So the > reasoning for SCRAM-* to not support it because HTTP does not define = it, > does not seem to apply here. I hope I'm not poking in a hornet's nest > by saying this... >=20 >=20 > Given that the HTTPAUTH WG has been dismantled, I am not sure what to = do > next. Any advise is welcome. >=20 >=20 > Best wishes, >=20 > Rick van Rein > InternetWide.org / ARPA2.net / OpenFortress.nl >=20 > _______________________________________________ > http-auth mailing list > http-auth@ietf.org > https://www.ietf.org/mailman/listinfo/http-auth --Apple-Mail=_160FB130-7BC1-4BC5-B6B2-19885DE86549 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQEcBAEBCgAGBQJZkeNHAAoJELhJCxUKWMyZ1DkIAMkNF9fjc44ees2qegeE7Fxv GJSqykelduE9Ht3tDSN6qd6iQ+COhEA/yQDoY+/WnS1Cv6A1mp5RcPo237Kof+gI GkCuy41GfWDzRCW67m5UHiWBAJtQ5s7Xc08d6a4u4IFnb41dHoDCVVkJ+g/HbRTS rO1VWUhzoYd9DHTqLixCeYkVoXBYxGmAv1yRbzeW7Gdp4JTpbAoSCthwwxJq6k6N Y4KeQzskuB5mAivUCIRtEwzFgziFYRqS4BtKuiV/oEaWRpiTqRLccr4jzlcBahh2 fapNw45ntqGPm7vuTrAhfaGzZShZZP3VYwKv+bKLHHBAg6SELag5QG0erYenxX8= =vNDr -----END PGP SIGNATURE----- --Apple-Mail=_160FB130-7BC1-4BC5-B6B2-19885DE86549--