This is an automated email from the git hooks/post-receive script.
firstyear pushed a commit to branch master
in repository 389-ds-base.
commit 6fa30ec4b28db045e3bad00313f391811d1c53ad
Author: William Brown <firstyear(a)redhat.com>
Date: Tue Feb 28 11:17:20 2017 +1000
Ticket 48707 - Update rfc to accomodate that authid is mandatory
Fix Description: authid in sasl is mandatory, so we should include this.
https://pagure.io/389-ds-base/issue/48707
Author: wibrown
Review by: mreynolds (Thanks!)
---
rfcs/Makefile | 2 +-
rfcs/src/draft-wibrown-ldapssotoken-00.xml | 16 ++++++++++++++--
2 files changed, 15 insertions(+), 3 deletions(-)
diff --git a/rfcs/Makefile b/rfcs/Makefile
index e868d38..31db4d4 100644
--- a/rfcs/Makefile
+++ b/rfcs/Makefile
@@ -1,5 +1,5 @@
-allrfcs: folders examplerfcs draft-wibrown-ldapssotoken-00
+allrfcs: folders draft-wibrown-ldapssotoken-00
folders:
mkdir -p txt
diff --git a/rfcs/src/draft-wibrown-ldapssotoken-00.xml
b/rfcs/src/draft-wibrown-ldapssotoken-00.xml
index c503744..24cdf0f 100644
--- a/rfcs/src/draft-wibrown-ldapssotoken-00.xml
+++ b/rfcs/src/draft-wibrown-ldapssotoken-00.xml
@@ -1,6 +1,7 @@
<?xml version="1.0" encoding="US-ASCII"?>
<!DOCTYPE rfc SYSTEM "rfc2629.dtd" [
+<!ENTITY RFC2078 SYSTEM
"http://xml.resource.org/public/rfc/bibxml/reference.RFC.2078.xml">
<!ENTITY RFC2119 SYSTEM
"http://xml.resource.org/public/rfc/bibxml/reference.RFC.2119.xml">
<!ENTITY RFC2222 SYSTEM
"http://xml.resource.org/public/rfc/bibxml/reference.RFC.2222.xml">
<!ENTITY RFC4511 SYSTEM
"http://xml.resource.org/public/rfc/bibxml/reference.RFC.4511.xml">
@@ -15,7 +16,7 @@
<?rfc sortrefs="yes" ?>
<?rfc compact="yes" ?>
<?rfc subcompact="no" ?>
-<rfc category="std" docName="draft-wibrown-ldapssotoken-01"
ipr="trust200902">
+<rfc category="std" docName="draft-wibrown-ldapssotoken-02"
ipr="trust200902">
<front>
@@ -90,7 +91,7 @@
</address>
</author>
- <date year="2016"></date>
+ <date year="2017"></date>
<area>General</area>
@@ -235,6 +236,9 @@ Date Time Until || User Unique Id
The acquisition method for the token is discussed in section XXX.</t>
<t>For authentication, the client MUST send the token as it was
received.
IE changes to formatting are not permitted.</t>
+ <t>The client MUST send the an appropriate authid in <xref
target="RFC2078">RFC 2078</xref>
+ form. This authid MUST internally match the User Unique Id in the token. The
server
+ is responsible for this validation.</t>
<t>The client MAY transform the token if acting in a proxy fashion.
However this transformation must be deterministic and able to be
reversed to satisfy the previous requirement.</t>
@@ -276,6 +280,8 @@ Date Time Until || User Unique Id
<section title="SASL Authentication">
<t>The client issues a SASL bind request with the mechanism name
LDAPSSOTOKEN.</t>
+ <t>The client sends an appropriate authid in <xref
target="RFC2078">RFC 2078</xref>
+ form.</t>
<t>The client provides the encrypted token that was provided in
the LDAPSSOTokenResponse Token Field.</t>
<t>The token is decrypted and authenticated based on the token
@@ -296,6 +302,10 @@ Date Time Until || User Unique Id
invalidCredentials MUST be returned.</t>
<t>The User Unique Id is validated to exist on the server. If the User
Unique Id
does not exist, invalidCredentials MUST be returned.</t>
+ <t>The authid provided by the SASL client is verified with the User
Unique Id. For example
+ if the authid is william(a)EXAMPLE.COM, the server maps this to an identity.
Once this
+ identity is validated, the identity is check to match the User Unique Id. If
they do not
+ match, the authentication MUST fail.</t>
<t>The DateTimeIssued field is validated against the User Unique Id
object's
attribute or related attribute that contains "Valid Not Before". If
the value of
"Valid Not Before" exceeds or is equal to DateTimeIssued,
@@ -414,6 +424,8 @@ LDAPSSOTokenResponse ::= SEQUENCE {
</references>
<references title="Informative References">
+ &RFC2078;
+
&RFC2222;
&RFC4511;
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.