A Simple Authentication and Security Layer (SASL) and Generic Security Service Application Program Interface (GSS-API) Mechanism for OpenID
RFC 6616
Internet Engineering Task Force (IETF) E. Lear
Request for Comments: 6616 Cisco Systems GmbH
Category: Standards Track H. Tschofenig
ISSN: 2070-1721 Nokia Siemens Networks
H. Mauldin
Cisco Systems, Inc.
S. Josefsson
SJD AB
May 2012
A Simple Authentication and Security Layer (SASL) and
Generic Security Service Application Program Interface (GSS-API)
Mechanism for OpenID
Abstract
OpenID has found its usage on the Internet for Web Single Sign-On.
Simple Authentication and Security Layer (SASL) and the Generic
Security Service Application Program Interface (GSS-API) are
application frameworks to generalize authentication. This memo
specifies a SASL and GSS-API mechanism for OpenID that allows the
integration of existing OpenID Identity Providers with applications
using SASL and GSS-API.
Status of This Memo
This is an Internet Standards Track document.
This document is a product of the Internet Engineering Task Force
(IETF). It represents the consensus of the IETF community. It has
received public review and has been approved for publication by the
Internet Engineering Steering Group (IESG). Further information on
Internet Standards is available in Section 2 of RFC 5741.
Information about the current status of this document, any errata,
and how to provide feedback on it may be obtained at
http://www.rfc-editor.org/info/rfc6616.
Lear, et al. Standards Track [Page 1]
RFC 6616 SASL & GSS-API Mechanism for OpenID May 2012
Copyright Notice
Copyright (c) 2012 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3
1.1. Terminology . . . . . . . . . . . . . . . . . . . . . . . 4
1.2. Applicability . . . . . . . . . . . . . . . . . . . . . . 4
2. Applicability for Application Protocols other than HTTP . . . 4
2.1. Binding SASL to OpenID in the Relying Party . . . . . . . 7
2.2. Discussion . . . . . . . . . . . . . . . . . . . . . . . . 8
3. OpenID SASL Mechanism Specification . . . . . . . . . . . . . 8
3.1. Initiation . . . . . . . . . . . . . . . . . . . . . . . . 9
3.2. Authentication Request . . . . . . . . . . . . . . . . . . 9
3.3. Server Response . . . . . . . . . . . . . . . . . . . . . 10
3.4. Error Handling . . . . . . . . . . . . . . . . . . . . . . 11
4. OpenID GSS-API Mechanism Specification . . . . . . . . . . . . 11
4.1. GSS-API Principal Name Types for OpenID . . . . . . . . . 12
5. Example . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
6. Security Considerations . . . . . . . . . . . . . . . . . . . 14
6.1. Binding OpenIDs to Authorization Identities . . . . . . . 14
6.2. RP Redirected by Malicious URL to Take an Improper
Action . . . . . . . . . . . . . . . . . . . . . . . . . . 14
6.3. User Privacy . . . . . . . . . . . . . . . . . . . . . . . 14
7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 15
8. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 15
9. References . . . . . . . . . . . . . . . . . . . . . . . . . . 15
9.1. Normative References . . . . . . . . . . . . . . . . . . . 15
9.2. Informative References . . . . . . . . . . . . . . . . . . 17
Lear, et al. Standards Track [Page 2]
RFC 6616 SASL & GSS-API Mechanism for OpenID May 2012
1. Introduction
OpenID 2.0 [OpenID] is a web-based three-party protocol that provides
a means for a user to offer identity assertions and other attributes
to a web server (Relying Party) via the help of an identity provider.
The purpose of this system is to provide a way to verify that an end
user controls an identifier.
Simple Authentication and Security Layer (SASL) [RFC4422] is used by
Show full document text