idnits 2.17.1 draft-sanchez-webdav-current-principal-02.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- ** It looks like you're using RFC 3978 boilerplate. You should update this to the boilerplate described in the IETF Trust License Policy document (see https://trustee.ietf.org/license-info), which is required now. -- Found old boilerplate from RFC 3978, Section 5.1 on line 15. -- Found old boilerplate from RFC 3978, Section 5.5, updated by RFC 4748 on line 237. -- Found old boilerplate from RFC 3979, Section 5, paragraph 1 on line 248. -- Found old boilerplate from RFC 3979, Section 5, paragraph 2 on line 255. -- Found old boilerplate from RFC 3979, Section 5, paragraph 3 on line 261. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- == No 'Intended status' indicated for this document; assuming Proposed Standard Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- No issues found here. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust Copyright Line does not match the current year -- The document seems to lack a disclaimer for pre-RFC5378 work, but may have content which was first submitted before 10 November 2008. If you have contacted all the original authors and they are all willing to grant the BCP78 rights to the IETF Trust, then this is fine, and you can ignore this comment. If not, you may need to add the pre-RFC5378 disclaimer. (See the Legal Provisions document at https://trustee.ietf.org/license-info for more information.) -- The document date (October 31, 2008) is 5656 days in the past. Is this intentional? Checking references for intended status: Proposed Standard ---------------------------------------------------------------------------- (See RFCs 3967 and 4897 for information about using normative references to lower-maturity documents in RFCs) ** Obsolete normative reference: RFC 2616 (Obsoleted by RFC 7230, RFC 7231, RFC 7232, RFC 7233, RFC 7234, RFC 7235) Summary: 2 errors (**), 0 flaws (~~), 2 warnings (==), 7 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 Network Working Group W. Sanchez 3 Internet-Draft C. Daboo 4 Expires: May 4, 2009 Apple Inc. 5 October 31, 2008 7 WebDAV Current Principal Extension 8 draft-sanchez-webdav-current-principal-02 10 Status of This Memo 12 By submitting this Internet-Draft, each author represents that any 13 applicable patent or other IPR claims of which he or she is aware 14 have been or will be disclosed, and any of which he or she becomes 15 aware will be disclosed, in accordance with Section 6 of BCP 79. 17 Internet-Drafts are working documents of the Internet Engineering 18 Task Force (IETF), its areas, and its working groups. Note that 19 other groups may also distribute working documents as Internet- 20 Drafts. 22 Internet-Drafts are draft documents valid for a maximum of six months 23 and may be updated, replaced, or obsoleted by other documents at any 24 time. It is inappropriate to use Internet-Drafts as reference 25 material or to cite them other than as "work in progress." 27 The list of current Internet-Drafts can be accessed at 28 http://www.ietf.org/ietf/1id-abstracts.txt. 30 The list of Internet-Draft Shadow Directories can be accessed at 31 http://www.ietf.org/shadow.html. 33 This Internet-Draft will expire on May 4, 2009. 35 Abstract 37 This specification defines a new WebDAV property that allows clients 38 to quickly determine the principal corresponding to the current 39 authenticated user. 41 Table of Contents 43 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3 44 2. Conventions Used in This Document . . . . . . . . . . . . . . . 3 45 3. DAV:current-user-principal . . . . . . . . . . . . . . . . . . 4 46 4. Security Considerations . . . . . . . . . . . . . . . . . . . . 5 47 5. IANA Considerations . . . . . . . . . . . . . . . . . . . . . . 5 48 6. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . 5 49 7. Normative References . . . . . . . . . . . . . . . . . . . . . 5 50 Appendix A. Change History (to be removed prior to 51 publication as an RFC) . . . . . . . . . . . . . . . . 5 53 1. Introduction 55 WebDAV [RFC4918] is an extension to HTTP [RFC2616] to support 56 improved document authoring capabilities. The WebDAV Access Control 57 Protocol ("WebDAV ACL") [RFC3744] extension adds access control 58 capabilities to WebDAV. It introduces the concept of a "principal" 59 resource, which is used to represent information about authenticated 60 entities on the system. 62 Some clients have a need to determine the [RFC3744] principal that a 63 server is associating with the currently authenticated HTTP user. 64 While [RFC3744] defines a DAV:current-user-privilege-set property for 65 retrieving the privileges granted to that principal, there is no 66 recommended way to identify the principal in question, which is 67 necessary to perform other useful operations. For example, a client 68 may wish to determine which groups the current user is a member of, 69 or modify a property of the principal resource associated with the 70 current user. 72 The DAV:principal-match REPORT provides some useful functionality, 73 but there are common situations where the results from that query can 74 be ambiguous. For example, not only is an individual user principal 75 returned, but also every group principal that the user is a member 76 of, and there is no clear way to distinguish which is which. 78 This specification proposes an extension to WebDAV ACL that adds a 79 DAV:current-user-principal property to resources under access control 80 on the server. This property provides a URL to a principal resource 81 corresponding to the currently authenticated user. This allows a 82 client to "bootstrap" itself by performing additional queries on the 83 principal resource to obtain additional information from that 84 resource, which is the purpose of this extension. Note that while it 85 is possible for multiple URLs to refer to the same principal 86 resource, or for multiple principal resources to correspond to a 87 single principal, this specification only allows for a single http(s) 88 URL in the DAV:current-user-principal property. If a client wishes 89 to obtain alternate URLs for the principal, it can query the 90 principal resource for this information; it is not the purpose of 91 this extension to provide a complete list of such URLs, but simply to 92 provide a means to locate a resource which contains that (and other) 93 information. 95 2. Conventions Used in This Document 97 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 98 "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this 99 document are to be interpreted as described in [RFC2119]. 101 When XML element types in the namespace "DAV:" are referenced in this 102 document outside of the context of an XML fragment, the string "DAV:" 103 will be prefixed to the element type names. 105 Processing of XML by clients and servers MUST follow the rules 106 defined in Section 17 of WebDAV [RFC4918]. 108 Some of the declarations refer to XML elements defined by WebDAV 109 [RFC4918]. 111 3. DAV:current-user-principal 113 Name: current-user-principal 115 Namespace: DAV: 117 Purpose: Indicates a URL for the currently authenticated user's 118 principal resource on the server. 120 Value: A single DAV:href or DAV:unauthenticated element. 122 Protected: This property is computed on a per-request basis, and 123 therefore is protected. 125 Description: The DAV:current-user-principal property contains either 126 a DAV:href or DAV:unauthenticated XML element. The DAV:href 127 element contains a URL to a principal resource corresponding to 128 the currently authenticated user. That URL MUST be one of the 129 URLs in the DAV:principal-URL or DAV:alternate-URI-set properties 130 defined on the principal resource and MUST be an http(s) scheme 131 URL. When authentication has not been done or has failed, this 132 property MUST contain the DAV:unauthenticated pseudo-principal. 134 In some cases there may be multiple principal resources 135 corresponding to the same authenticated principal. In that case 136 the server is free to choose any one of the principal resource 137 URIs for the value of the DAV:current-user-principal property. 138 However, servers SHOULD be consistent and use the same principal 139 resource URI for each authenticated principal. 141 COPY/MOVE behavior: This property is computed on a per-request 142 basis, and is thus never copied or moved. 144 Definition: 146 147 149 Example: 151 152 /principals/users/cdaboo 153 155 4. Security Considerations 157 This specification does not introduce any additional security issues 158 beyond those defined for HTTP [RFC2616], WebDAV [RFC4918] and WebDAV 159 ACL [RFC3744]. 161 5. IANA Considerations 163 This document does not require any actions on the part of IANA. 165 6. Acknowledgments 167 This specification is based on discussions that took place within the 168 Calendaring and Scheduling Consortium's CalDAV Technical Committee. 169 The authors thank the participants of that group for their input. 171 The authors thank Julian Reschke for his valuable input via the 172 WebDAV working group mailing list. 174 7. Normative References 176 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 177 Requirement Levels", BCP 14, RFC 2119, March 1997. 179 [RFC2616] Fielding, R., Gettys, J., Mogul, J., Frystyk, H., 180 Masinter, L., Leach, P., and T. Berners-Lee, "Hypertext 181 Transfer Protocol -- HTTP/1.1", RFC 2616, June 1999. 183 [RFC3744] Clemm, G., Reschke, J., Sedlar, E., and J. Whitehead, "Web 184 Distributed Authoring and Versioning (WebDAV) 185 Access Control Protocol", RFC 3744, May 2004. 187 [RFC4918] Dusseault, L., "HTTP Extensions for Web Distributed 188 Authoring and Versioning (WebDAV)", RFC 4918, June 2007. 190 Appendix A. Change History (to be removed prior to publication as an 191 RFC) 193 Changes from -00: 195 1. Changed DAV:current-user-principal-resource to DAV:current-user- 196 principal. 198 2. Correct DAV:current-user-principal element definition to use 199 valid XML and not use the "DAV:" prefix for children. 201 3. Typo "DAV:unauthenticed" should be spelled "DAV:unauthenticated". 203 Authors' Addresses 205 Wilfredo Sanchez 206 Apple Inc. 207 1 Infinite Loop 208 Cupertino, CA 95014 209 USA 211 EMail: wsanchez@wsanchez.net 212 URI: http://www.apple.com/ 214 Cyrus Daboo 215 Apple Inc. 216 1 Infinite Loop 217 Cupertino, CA 95014 218 USA 220 EMail: cyrus@daboo.name 221 URI: http://www.apple.com/ 223 Full Copyright Statement 225 Copyright (C) The IETF Trust (2008). 227 This document is subject to the rights, licenses and restrictions 228 contained in BCP 78, and except as set forth therein, the authors 229 retain all their rights. 231 This document and the information contained herein are provided on an 232 "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS 233 OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND 234 THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS 235 OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF 236 THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED 237 WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. 239 Intellectual Property 241 The IETF takes no position regarding the validity or scope of any 242 Intellectual Property Rights or other rights that might be claimed to 243 pertain to the implementation or use of the technology described in 244 this document or the extent to which any license under such rights 245 might or might not be available; nor does it represent that it has 246 made any independent effort to identify any such rights. Information 247 on the procedures with respect to rights in RFC documents can be 248 found in BCP 78 and BCP 79. 250 Copies of IPR disclosures made to the IETF Secretariat and any 251 assurances of licenses to be made available, or the result of an 252 attempt made to obtain a general license or permission for the use of 253 such proprietary rights by implementers or users of this 254 specification can be obtained from the IETF on-line IPR repository at 255 http://www.ietf.org/ipr. 257 The IETF invites any interested party to bring to its attention any 258 copyrights, patents or patent applications, or other proprietary 259 rights that may cover technology that may be required to implement 260 this standard. Please address the information to the IETF at 261 ietf-ipr@ietf.org.