Re: Holding gs2

[Sam Hartman <hartmans-ietf@xxxxxxx>]

>>>>> "Jeffrey" == Jeffrey Hutzelman <jhutz@xxxxxxx> writes:

    Jeffrey> The main drawback to this approach is that it means GS2
    Jeffrey> can be used only with GSS-API mechanisms for which such
    Jeffrey> an AS exists.  That's fine if the only mechanisms are
    Jeffrey> standards-track base mechanisms, but things start to get
    Jeffrey> hairy if we want to allow for the use of stackable
    Jeffrey> mechanisms or of privately-defined mechanisms.  Of
    Jeffrey> course, whoever defines a private mechanism could also
    Jeffrey> specify GS2's applicability to that mechanism, at least
    Jeffrey> for anyone for which it matters.
I consider this a very significant drawback.



    Jeffrey> All of that being said, it seems that maybe we're
    Jeffrey> worrying too much.  Last I knew we had an effort underway
    Jeffrey> which it was hoped would produce a non-Kerberos GS2
    Jeffrey> mechanism.  Whether that actually materializes or not, I
    Jeffrey> think we have basically worked out what it needs to look
    Jeffrey> like to work with GS2.  Do we believe that is not
    Jeffrey> sufficient to demonstrate that GS2 can successfully be


I am unconvinced we understand how to apply GS2 to mechanisms beyond
kerberos in a manner such that those mechanisms can easily be coded as
pure sasl mechanisms.  I'm concerned about unnecessary optional
exchanges and complicated control flow.

I suspect that Chris and others will not like the result if using gs2
complicates the potential control flows, adds variable round trips,
etc.


So, no I'm not convinced we know that gs2 can meet our needs.  Of
course with my leave, we have a month before GS2 could progress
anyway.  It would be really great if people could actually do the work
of specifying the mechanism for GS2 during that month.