Realms (DIGEST-MD5 and otherwise)

[Lawrence Greenfield <leg+@xxxxxxxxxxxxxx>]

Hi,

I've been thinking about multiple realms on servers a lot lately, and
it would simplify implementations as well as users if we can impose
some rules on valid realm strings.

I would propose that realms be DNS-style and should be in all
uppercase letters (and implementations may be free to uppercase realms
for the user).  This follows the conventions of Kerberos.  Allowing
any arbitrary, case-sensitive string that users might have to type in
is especially annoying.

Allowing @'s in realms is especially confusing, since it makes it
hard for a server to refer to a user as user@REALM.

Could we add this restriction to DIGEST-MD5 and propose it as a
guideline for future mechanisms?

Larry