Re: coments on draft-ietf-sacred-protocol-bss-00

   Date: Thu, 13 Dec 2001 16:22:01 +0000
   From: Stephen Farrell <[email protected]>
   Organization: Baltimore Technologies Ltd.
   CC: Lawrence Greenfield <[email protected]>, [email protected]

   Explain to me why I need separate authentication and
   authorization (sasl) identities for sacred? 

Disallowing this is nonsensical.  Server implementors can disallow it
if they don't want.  It's a standard SASL feature.  I use it regularly
to debug problems for users (authenticate as an administrator,
authorize as a user).

   We did have some calls that we aim for simplicity
   at the meeting.

This doesn't increase complexity; neither clients nor servers have to
implement it and it doesn't harm interoperability.  SACRED would be
the only protocol with this restriction, hurting code reuse.

Larry