Re: I-D Action:draft-ietf-sasl-gs2-14.txt

[Simon Josefsson <simon@xxxxxxxxxxxxx>]

Alexey Melnikov <alexey.melnikov@xxxxxxxxx> writes:

> Nicolas Williams wrote:
>
>>On Wed, Jul 08, 2009 at 01:11:57PM +0100, Alexey Melnikov wrote:
>>  
>>
>>>Some quick comments.
>>>
>>>In Section 3.5:
>>>    
>>>
>>>>  If the client negotiates mechanisms then clients MUST select the
>>>>  PLUS-variant if offered by the server.
>>>>      
>>>>
>>>This make sense.
>>>    
>>>
>>>>Otherwise, if the client does
>>>>  not negotiate mechanisms then it MUST use the non-PLUS variant.
>>>>      
>>>>
>>> This doesn't make much sense. If the client remembers what the
>>> server advertised previously, then it can just use the same
>>> mechanism.
>>> But even if the client never negotiate mechanisms (e.g. if the user
>>> selected the mechanism in UI), then why should it be restricted to
>>> non-PLUS variant?
>>>    
>>>
>>I think that text had been intended to say that the non-PLUS variant
>>must be selected when the client has no idea what the server supports
>>and the client isn't using CB.  But it doesn't really matter.  I'd be
>>happy with removing this text.
>>  
>>
> Alternatively I suggest correcting the text to read something like this:
>
>    Otherwise (the client does not negotiate mechanisms),
>    if the client has no prior knowledge about mechanisms supported
>    by the server and wasn't explicitly configured to use a particular
>    variant of the GS2 mechanism, then it MUST select
>    only non-PLUS version of the GS2 mechanism.

Works fine with me.  I have made this change in my local copy.

/Simon