23 Sep 2009 20:19
IMAP extension for SASL additional information
Simon Josefsson <simon <at> josefsson.org>
2009-09-23 18:19:41 GMT
2009-09-23 18:19:41 GMT
Do IMAP support SASL authentication where the server returns additional information together with success? As far as I can tell from section 6.2.2 of RFC 3501 it does not, but I may be missing something. Is there interest in an extension, say "SASL-AD", to provide this capability? It could work like this: C: . CAPABILITY S: * CAPABILITY SASL-AD C: . AUTHENTICATE SCRAM-SHA-1 - SASL-AD S: + C: client-first-b64-string S: + server-first-b64-string C: client-final-b64-string S: . OK [SASL-AD server-final-b64-string] When used together with SASL-IR, an exchange could look like: C: . CAPABILITY S: * CAPABILITY SASL-IR SASL-AD C: . AUTHENTICATE SCRAM-SHA-1 client-first-b64-string SASL-AD S: + server-first-b64-string C: client-final-b64-string S: . OK [SASL-AD server-final-b64-string] Using "-" allows clients to avoid sending a client-first even if the server announces support for SASL-IR, thus enabling:(Continue reading)
RSS Feed