Subject: Passwords and WebDAV

From: "Dan Burton" <[email-masked]>
Date: Thu, 25 May 2000 16:28:48 -0600

This may be an issue that has scope beyond WebDAV, however the problems we are having are WebDAV related. Also I believe this is an issue that is more important to WebDAV then it is to the http protocol in general.

We need to have the ability to expire passwords to force users to change passwords. When a users password is expired they are given a number of grace logins. For normal http access, when a user on grace logins the web server can redirect them to a page that allows them to change their password. However, when using WebDAV clients (in particular web folders, and Office 2000) the redirect to a page to change passwords does not work. Given that a WebDAV client may not be a browser and therefore may not know how to display html there needs to be another solution for expired passwords. 

It seems to me that this could be something the WebDAV group could address. Maybe an addition to WebDAV that allows for notification that the users account needs to be updated (password changed) and a method of changing updating user account information.

---

From: Greg Stein <[email-masked]>
Date: Thu, 25 May 2000 16:44:12 -0700 (PDT)

IMO, changing passwords is out-of-scope of WebDAV.  There are too many
authentication systems and mechanisms out there, with too many variant
requirements for changing passwords.

While it would certainly be possible to create an HTTP-based protocol for
changing passwords, that seems to be an issue between the client and the
authentication system (which is probably separate from the web server).

YMMV

Cheers,
-g

On Thu, 25 May 2000, Dan Burton wrote:
> This may be an issue that has scope beyond WebDAV, however the
> problems we are having are WebDAV related. Also I believe this is an
> issue that is more important to WebDAV then it is to the http protocol
> in general.
> 
> We need to have the ability to expire passwords to force users to
> change passwords. When a users password is expired they are given a
> number of grace logins. For normal http access, when a user on grace
> logins the web server can redirect them to a page that allows them to
> change their password. However, when using WebDAV clients (in
> particular web folders, and Office 2000) the redirect to a page to
> change passwords does not work. Given that a WebDAV client may not be
> a browser and therefore may not know how to display html there needs
> to be another solution for expired passwords.
> 
> It seems to me that this could be something the WebDAV group could
> address. Maybe an addition to WebDAV that allows for notification that
> the users account needs to be updated (password changed) and a method
> of changing updating user account information.
> 

-- 
Greg Stein, http://www.lyra.org/

---

From: "Kevin Dyer" <[email-masked]>
Date: Fri, 26 May 2000 07:56:27 -0400

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of Greg Stein
> Sent: Thursday, May 25, 2000 7:44 PM
> To: Dan Burton
> Cc: <
> Subject: Re: Passwords and WebDAV
> 
> 

Changing passwords may be out-of-scope but providing a return code 
mechanism for revoking credentials, or to inform the user that their 
password/temporary password must be renewed is not.  About a year and a 
half ago I made a suggestion to the HTTP-WG that we add a return code
or set of return codes to do just that.  Provide a mechanism to the
underlying authentication and authorization systems that allows the
system to notify it's users in a standardized manner that something 
needs to be addressed.  The suggestion was tabled due to the timing
and where 1.1 was in the loop.

As Dan points out most of the new clients that are interfacing with
a WebDAV server are not browsers so they are incapable of displaying
HTML pages. So what do we put into the protocol to allow such 
interoperability?

> > change passwords. When a users password is expired they are given a
[snip Dan's description of non-browser interactions]