Subject: RE: Passwords and WebDAV

From: "Dan Burton" <[email-masked]>
Date: Thu, 01 Jun 2000 09:14:09 -0600

In my original message I said this may be out of the scope of WebDAV, but now I think it is critical to WebDAV. We a currently working on this issue with a large customer. With a normal HTTP client (one that renders html) it is possible to solve the expired password problem. However, with WebDAV clients there currently is no way to solve this problem. This is currently THE issue that is preventing the adoption of WebDAV for this customer. If we want to have people use the WebDAV protocol we have to be willing to solve problems like this one.

>>> "Kevin Dyer" <[email-masked]> 05/26/00 05:56AM >>>
Changing passwords may be out-of-scope but providing a return code 
mechanism for revoking credentials, or to inform the user that their 
password/temporary password must be renewed is not.  About a year and a 
half ago I made a suggestion to the HTTP-WG that we add a return code
or set of return codes to do just that.  Provide a mechanism to the
underlying authentication and authorization systems that allows the
system to notify it's users in a standardized manner that something 
needs to be addressed.  The suggestion was tabled due to the timing
and where 1.1 was in the loop.

As Dan points out most of the new clients that are interfacing with
a WebDAV server are not browsers so they are incapable of displaying
HTML pages. So what do we put into the protocol to allow such 
interoperability?

---

From: Jim Whitehead <[email-masked]>
Date: Thu, 1 Jun 2000 15:21:21 -0700

Hmm, well I can see how this is an important deployment issue. I think the
problem of notifying the user that their password has expired would be
easier than providing a password modification protocol.

It seems to be this problem isn't inherent to authoring -- regular Web
access could run into this problem as well.  For example, if my subscription
to an online magazine, or digital library runs out, I might want to receive
a message as well.  But, authoring certainly does bring in clients that do
not have HTML rendering capability.

I think the best way to address this would be for someone to volunteer to
write up an Internet Draft describing a new status code, and its meaning, to
cover the password expiration, and password refresh cases.  I think it
should scrupulously avoid functionality that would allow a user to reset
their password, unless it involved returning the URL of a Web page that
would allow the password to be reset.

But, this wouldn't affect existing WebDAV clients fast enough to affect your
current situation -- for that, one option is to use email as a notification
service, telling users their passwords have expired.

- Jim

> In my original message I said this may be out of the scope of
> WebDAV, but now I think it is critical to WebDAV. We a currently
> working on this issue with a large customer. With a normal HTTP
> client (one that renders html) it is possible to solve the
> expired password problem. However, with WebDAV clients there
> currently is no way to solve this problem. This is currently THE
> issue that is preventing the adoption of WebDAV for this
> customer. If we want to have people use the WebDAV protocol we
> have to be willing to solve problems like this one.