Re: SASL Semantics Within LDAP

Roger Harrison wrote:

> Hallvard,
>
> Shortly after sending a proposed new section 5.2.2 for authmeth-17, I 
> rediscovered your email on the same subject from last March. I've 
> reworked section 5.2.2, as below. I'd appreciate comments and feedback 
> prior to my submitting authmeth-17 on Friday.
>
I think I've missed few issues before:

> 5.2.2. SASL Semantics Within LDAP
>
> Implementers must take care to ensure that they maintain the semantics 
> of SASL specifications when handling data that has different semantics 
> in the LDAP protocol.
>
> For example, the SASL DIGEST-MD5 authentication mechanism [RFC2829] 
> utilizes an authentication identity (username)
>
A bit of nit picking: according to SASL "username" is not authentication 
identity, it is authorization identity. So I suggested you remove 
"(username)".

> and a realm which are syntactically simple strings and semantically 
> simple username and realm values ([DIGEST-MD5] section 2.1). These 
> values are not LDAP DNs, and there is no requirement that they be 
> represented or treated as such.
>
[...]

> To illustrate, the two DNs <cn=Bob,dc=example,dc=com> (upper case "B") 
> and <cn=bob,dc=example,dc=com> (lower case "b") are equivalent when 
> being compared semantically as LDAP DNs because the cn attribute is 
> defined to be case insensitive, however the two values are not 
> equivalent if they represent username values in DIGEST‑MD5 because 
> DIGEST‑MD5 matching is case‑sensitive.
>
"username" ==> "authentication identity".

The client has to treat authentication identities and realms as 
case-sensitive, because it doesn't know if the server treats them as 
case-sensitive or not.
However a server implementation can treat authentication 
identities/realms as case-insensitive and I know that some existing 
implementations are. For such servers the last statement is not correct. 
So I suggest to weaken the last sentence: "however the two values are 
not necessarily equivalent .. because DIGEST-MD5 matching might be 
case-sensitive". Or "because DIGEST‑MD5 matching is usually case‑sensitive".