A set of SASL Mechanisms for OAuth
draft-ietf-kitten-sasl-oauth-22
The information below is for an old version of the document |
Document |
Type |
|
Active Internet-Draft (kitten WG)
|
|
Last updated |
|
2015-05-28
(latest revision 2015-04-30)
|
|
Replaces |
|
draft-mills-kitten-sasl-oauth
|
|
Stream |
|
IETF
|
|
Intended RFC status |
|
Proposed Standard
|
|
Formats |
|
plain text
pdf
html
bibtex
|
|
Additional URLs |
|
|
Stream |
WG state
|
|
Submitted to IESG for Publication
|
|
Document shepherd |
|
Benjamin Kaduk
|
|
Shepherd write-up |
|
Show
(last changed 2015-04-17)
|
IESG |
IESG state |
|
Approved-announcement to be sent::Point Raised - writeup needed
|
|
Consensus Boilerplate |
|
Yes
|
|
Telechat date |
|
|
|
Responsible AD |
|
Stephen Farrell
|
|
Send notices to |
|
kaduk@mit.edu, kitten-chairs@ietf.org, draft-ietf-kitten-sasl-oauth.shepherd@ietf.org, draft-ietf-kitten-sasl-oauth@ietf.org, draft-ietf-kitten-sasl-oauth.ad@ietf.org
|
IANA |
IANA review state |
|
IANA OK - Actions Needed
|
|
IANA action state |
|
None
|
KITTEN W. Mills
Internet-Draft Microsoft
Intended status: Standards Track T. Showalter
Expires: November 1, 2015
H. Tschofenig
ARM Ltd.
April 30, 2015
A set of SASL Mechanisms for OAuth
draft-ietf-kitten-sasl-oauth-22.txt
Abstract
OAuth enables a third-party application to obtain limited access to a
protected resource, either on behalf of a resource owner by
orchestrating an approval interaction, or by allowing the third-party
application to obtain access on its own behalf.
This document defines how an application client uses credentials
obtained via OAuth over the Simple Authentication and Security Layer
(SASL) to access a protected resource at a resource serve. Thereby,
it enables schemes defined within the OAuth framework for non-HTTP-
based application protocols.
Clients typically store the user's long-term credential. This does,
however, lead to significant security vulnerabilities, for example,
when such a credential leaks. A significant benefit of OAuth for
usage in those clients is that the password is replaced by a shared
secret with higher entropy, i.e., the token. Tokens typically
provide limited access rights and can be managed and revoked
separately from the user's long-term password.
Status of This Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
Mills, et al. Expires November 1, 2015 [Page 1]
Internet-Draft SASL OAuth April 2015
This Internet-Draft will expire on November 1, 2015.
Copyright Notice
Copyright (c) 2015 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3
2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 5
3. OAuth SASL Mechanism Specifications . . . . . . . . . . . . . 6
3.1. Initial Client Response . . . . . . . . . . . . . . . . . 7
3.1.1. Reserved Key/Values . . . . . . . . . . . . . . . . . 8
3.2. Server's Response . . . . . . . . . . . . . . . . . . . . 8
3.2.1. OAuth Identifiers in the SASL Context . . . . . . . . 9
3.2.2. Server Response to Failed Authentication . . . . . . 9
3.2.3. Completing an Error Message Sequence . . . . . . . . 10
3.3. OAuth Access Token Types using Keyed Message Digests . . 11
4. Examples . . . . . . . . . . . . . . . . . . . . . . . . . . 12
4.1. Successful Bearer Token Exchange . . . . . . . . . . . . 12
4.2. Successful OAuth 1.0a Token Exchange . . . . . . . . . . 13
4.3. Failed Exchange . . . . . . . . . . . . . . . . . . . . . 14
4.4. SMTP Example of a Failed Negotiation . . . . . . . . . . 15
5. Security Considerations . . . . . . . . . . . . . . . . . . . 16
6. Internationalization Considerations . . . . . . . . . . . . . 17
7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 17
7.1. SASL Registration . . . . . . . . . . . . . . . . . . . . 17
8. References . . . . . . . . . . . . . . . . . . . . . . . . . 18
8.1. Normative References . . . . . . . . . . . . . . . . . . 18
8.2. Informative References . . . . . . . . . . . . . . . . . 19
Appendix A. Acknowlegements . . . . . . . . . . . . . . . . . . 20
Appendix B. Document History . . . . . . . . . . . . . . . . . . 20
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 23
Show full document text