[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Protocol Authentication

On Fri, 18 Mar 2005 14:07:29 -0800 (PST), John Panzer <"jpanzer"@aol.net> wrote:
>  In this context, 'support' is a bad word (I knew this, and just listened to
> a talk by Karl Wiegers that highlighted this as a word to avoid in specs). 
> Here's my interpretation of 'support HTTP X Auth':
>  
>  "An Atom server which requires authentication for a particular request, and
> which receives a request lacking authentication [1], shall respond with a
> 403 and a WWW-Authenticate: challenge to the client.  Such a challenge MUST
> include the HTTP X[2] Auth scheme.  Further, an Atom server which requires
> authentication for a particular request, and which receives an otherwise
> unauthenticated request containing a WWW-Authenticate: header providing HTTP
> X Auth information, MUST use the provided HTTP X Auth information to attempt
> to authenticate the requestor.  A server SHOULD ignore HTTP X Auth
> information if, and only if, it has already authenticated a request using
> some other mechanism."

I'm not even sure we should go that far in restricting things, doesn't
the above wording rule out using TLS and IPSec, which I vaguely recall
can both supply authentication?

   -joe

-- 
Joe Gregorio        http://bitworking.org