Re: Extensibility of InfoResponse CreateAccountRequest PDUs

Gareth,

You're right about this and I guess we ought to make a change.

I strongly prefer your first suggestion since I dislike adding
yet more schema constructs (i.e extension) that I don't fully
understand.

So, I've changed my working draft to reflect your first 
suggestion below.

I note that this allows a credential server to respond with
sets of DigestMD5AuthParams (e.g. >1 realm's worth of stuff)
which I also like. I've added some warning text that clients
might see this too.

Do we really need the <choice maxOccurs="unbounded"> in 
the create account request AuthInfoType? I'd have thought that 
one single thing was fine, but have left things as you suggest 
for now.

Stephen.

"Richards, Gareth" wrote:
> 
> The current InfoResponse and CreateAccountRequest PDUs do not appear to
> easily support servers that can handle authentication mechanisms in additon
> to SASL-MD5. For example, the current AuthParams returned by the
> InfoResponse must contain either a DigestMD5AuthParams or a sequence of one
> or more elements not in the Sacred namespace.  It is therefore not possible
> to return a DigestMD5AuthParams and something else.
> 
> A simple solution would be to redefine the types as follows:
> 
>   <complexType name="AuthParamsType">
>     <choice maxOccurs="unbounded">
>       <element name="DigestMD5AuthParams">
>         <complexType>
>           <sequence>
>             <element name="Realm" type="string"  minOccurs="1"
> maxOccurs="unbounded"/>
>           </sequence>
>         </complexType>
>       </element>
>       <any namespace="##other"/>
>     </choice>
>   </complexType>
> 
>   <complexType name="AuthInfoType">
>     <choice maxOccurs="unbounded">
>       <element name="DigestMD5AuthInfo">
>         <complexType>
>           <sequence>
>             <element name="PasswordVerifier" type="ds:CryptoBinary"/>
>             <element name="Realm" type="string" />
>           </sequence>
>         </complexType>
>       </element>
>       <any namespace="##other"/>
>     </choice>
>   </complexType>
> 
> Alternatively, the various AuthParams and AuthInfo elements could be derived
> from base types.  This stricter schema would allow the parser to do type
> checking on the elements contained within these PDUs where the current
> version does not and so allow extra mechanisms to be added in a well defined
> way.
> 
> For example, the AuthParamsType could be defined as follows:
> 
>   <complexType name="DigestMD5ParamsType">
>     <complexContent>
>       <extension base="sacred:MechanismParamsType">
>         <sequence>
>           <element name="Realm" type="string"  minOccurs="1"
> maxOccurs="unbounded"/>
>         </sequence>
>       </extension>
>     </complexContent>
>   </complexType>
> 
>   <complexType name="MechanismParamsType">
>     <attribute name="Name" type="string" use="required"/>
>   </complexType>
> 
>   <complexType name="AuthParamsType">
>     <sequence minOccurs="1" maxOccurs="unbounded">
>       <element name="Mechanism" type="sacred:MechanismParamsType"/>
>     </sequence>
>   </complexType>

-- 
____________________________________________________________
Stephen Farrell         				   
Baltimore Technologies,   tel: (direct line) +353 1 881 6716
39 Parkgate Street,                     fax: +353 1 881 7000
Dublin 8.                mailto:[email protected]
Ireland                             http://www.baltimore.com