Changeset 1356 for draft-ietf-httpbis/latest/p7-auth.xml

Timestamp:

Jul 26, 2011, 9:00:04 AM (8 years ago)

Author:

julian.reschke@…

Message:

Considerations for new authentications schemes (see #257)

File:

• draft-ietf-httpbis/latest/p7-auth.xml (modified) (3 diffs)

draft-ietf-httpbis/latest/p7-auth.xml

@@ -20 +20 @@
   <!ENTITY basic-rules                  "<xref target='Part1' x:rel='#basic.rules' xmlns:x='http://purl.org/net/xml2rfc/ext'/>">
   <!ENTITY effective-request-uri        "<xref target='Part1' x:rel='#effective.request.uri' xmlns:x='http://purl.org/net/xml2rfc/ext'/>">
+  <!ENTITY msg-orient-and-buffering     "<xref target='Part1' x:rel='#message-orientation-and-buffering' xmlns:x='http://purl.org/net/xml2rfc/ext'/>">
   <!ENTITY end-to-end.and-hop-by-hop    "<xref target='Part1' x:rel='#end-to-end.and.hop-by-hop.header-fields' xmlns:x='http://purl.org/net/xml2rfc/ext'/>">
   <!ENTITY shared-and-non-shared-caches "<xref target='Part6' x:rel='#shared.and.non-shared.caches' xmlns:x='http://purl.org/net/xml2rfc/ext'/>">
@@ -441 +442 @@
   The registry itself is maintained at <eref target="http://www.iana.org/assignments/http-authschemes"/>.
 </t>
+
+<section title="Considerations for New Authentication Schemes" anchor="considerations.for.new.authentication.schemes">
+<t>
+  There are certain aspects of the HTTP Authentication Framework that put
+  constraints on how new authentication schemes can work:
+</t>
+<t>
+  <list style="symbols">
+    <t>
+      Authentication schemes need to be compatible with the inherent
+      constraints of HTTP; for instance, that messages need to keep their
+      semantics when inspected in isolation, thus an authentication scheme
+      can not bind information to the TCP session over which the message
+      was received (see &msg-orient-and-buffering;). 
+    </t>
+    <t>
+      The authentication parameter "realm" is reserved for defining Protection
+      Spaces as defined in <xref target="protection.space"/>. New schemes
+      &MUST-NOT; use it in a way incompatible with that definition.
+    </t>
+    <t>
+      Authentication schemes need to document whther they are usable in
+      origin-server authentication (i.e., using WWW-Authenticate), and/or
+      proxy authentication (i.e., using Proxy-Authenticate).
+    </t>    
+    <!-- note about Authorization header -->
+  </list>
+</t>
+</section>
+
 </section>
 
@@ -1228 +1259 @@
       "Realm required on challenges"
     </t>
+    <t>
+      <eref target="http://tools.ietf.org/wg/httpbis/trac/ticket/257"/>:
+      "Considerations for new authentications schemes"
+    </t>
   </list>
 </t>