Re: Please review: http gss authentication mech

["RL 'Bob' Morgan" <rlmorgan at washington.edu>]

More significantly, draft-nystrom-http-sasl-12.txt only works when 
persistent connections are used, which is a showstopper.  Hence the 
text in http-gss:

   session.  Instead opaque identifiers in the GSS challenge option
   field are optionally used together with channel bindings to provide a
   way to share a security context over several HTTP connections.

 - RL "Bob"

> Tim Alsop wrote:
> > Have you considered using SASL over HTTP with GSS-API, as described in :
> >
> > http://tools.ietf.org/wg/sasl/draft-nystrom-http-sasl-12.txt
> >
> > I was under the impression that the above draft was the preferred method
> > to improve on the HTTP negotiate approach.
> I am under the impression that the proposed SASL mechanism doesn't 
> support channel bindings, partially because channel bindings have been a 
> notoriously difficult problem to get right in SASL space. Personally I 
> din't see the value of adding the extra layer of glue.
>
>    Cheers Leif
>
>
> _______________________________________________
> Kitten mailing list
> Kitten at lists.ietf.org
> https://www1.ietf.org/mailman/listinfo/kitten

_______________________________________________
Kitten mailing list
Kitten at lists.ietf.org
https://www1.ietf.org/mailman/listinfo/kitten