Re: sasl PLAIN and netscape communicator

[Nelson Tang <tang@xxxxxxxxxxx>]

>  Date: Tue, 08 Jun 1999 16:50:37 -0400
>  From: Tony Hansen <tony@xxxxxxx>
>  
>  The string passed in has an authorization identity but no
>  username.

It's legit.  The specification of the PLAIN SASL mechanism says:

"The client sends the authorization identity (identity to login as),
followed by a US-ASCII NUL character, followed by the authentication
identity (identity whose password will be used), followed by a US-ASCII
NUL character, followed by the clear-text password.  The client may
leave the authorization identity empty to indicate that it is the same
as the authentication identity."

[From www.ietf.org/internet-drafts/draft-newman-tls-imappop-09.txt, page
8, section 6.]

--nelson

~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~
Nelson Tang                                    tang@xxxxxxxxxxx
Internet Research Lab
UCLA Computer Science Deptartment              http://irl.cs.ucla.edu