A Simple Authentication and Security Layer (SASL) and Generic Security Service Application Program Interface (GSS-API) Mechanism for OpenID
RFC 6616

• Status
• IESG evaluation record
• IESG writeups
• Email expansions
• History

• Versions
• 08

Internet Engineering Task Force (IETF)                           E. Lear
Request for Comments: 6616                            Cisco Systems GmbH
Category: Standards Track                                  H. Tschofenig
ISSN: 2070-1721                                   Nokia Siemens Networks
                                                              H. Mauldin
                                                     Cisco Systems, Inc.
                                                            S. Josefsson
                                                                  SJD AB
                                                                May 2012

         A Simple Authentication and Security Layer (SASL) and
    Generic Security Service Application Program Interface (GSS-API)
                          Mechanism for OpenID

Abstract

   OpenID has found its usage on the Internet for Web Single Sign-On.
   Simple Authentication and Security Layer (SASL) and the Generic
   Security Service Application Program Interface (GSS-API) are
   application frameworks to generalize authentication.  This memo
   specifies a SASL and GSS-API mechanism for OpenID that allows the
   integration of existing OpenID Identity Providers with applications
   using SASL and GSS-API.

Status of This Memo

   This is an Internet Standards Track document.

   This document is a product of the Internet Engineering Task Force
   (IETF).  It represents the consensus of the IETF community.  It has
   received public review and has been approved for publication by the
   Internet Engineering Steering Group (IESG).  Further information on
   Internet Standards is available in Section 2 of RFC 5741.

   Information about the current status of this document, any errata,
   and how to provide feedback on it may be obtained at
   http://www.rfc-editor.org/info/rfc6616.

Lear, et al.                 Standards Track                    [Page 1]
RFC 6616           SASL & GSS-API Mechanism for OpenID          May 2012

Copyright Notice

   Copyright (c) 2012 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (http://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.

Table of Contents

   1.  Introduction . . . . . . . . . . . . . . . . . . . . . . . . .  3
     1.1.  Terminology  . . . . . . . . . . . . . . . . . . . . . . .  4
     1.2.  Applicability  . . . . . . . . . . . . . . . . . . . . . .  4
   2.  Applicability for Application Protocols other than HTTP  . . .  4
     2.1.  Binding SASL to OpenID in the Relying Party  . . . . . . .  7
     2.2.  Discussion . . . . . . . . . . . . . . . . . . . . . . . .  8
   3.  OpenID SASL Mechanism Specification  . . . . . . . . . . . . .  8
     3.1.  Initiation . . . . . . . . . . . . . . . . . . . . . . . .  9
     3.2.  Authentication Request . . . . . . . . . . . . . . . . . .  9
     3.3.  Server Response  . . . . . . . . . . . . . . . . . . . . . 10
     3.4.  Error Handling . . . . . . . . . . . . . . . . . . . . . . 11
   4.  OpenID GSS-API Mechanism Specification . . . . . . . . . . . . 11
     4.1.  GSS-API Principal Name Types for OpenID  . . . . . . . . . 12
   5.  Example  . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
   6.  Security Considerations  . . . . . . . . . . . . . . . . . . . 14
     6.1.  Binding OpenIDs to Authorization Identities  . . . . . . . 14
     6.2.  RP Redirected by Malicious URL to Take an Improper
           Action . . . . . . . . . . . . . . . . . . . . . . . . . . 14
     6.3.  User Privacy . . . . . . . . . . . . . . . . . . . . . . . 14
   7.  IANA Considerations  . . . . . . . . . . . . . . . . . . . . . 15
   8.  Acknowledgments  . . . . . . . . . . . . . . . . . . . . . . . 15
   9.  References . . . . . . . . . . . . . . . . . . . . . . . . . . 15
     9.1.  Normative References . . . . . . . . . . . . . . . . . . . 15
     9.2.  Informative References . . . . . . . . . . . . . . . . . . 17

Lear, et al.                 Standards Track                    [Page 2]
RFC 6616           SASL & GSS-API Mechanism for OpenID          May 2012

1.  Introduction

   OpenID 2.0 [OpenID] is a web-based three-party protocol that provides
   a means for a user to offer identity assertions and other attributes
   to a web server (Relying Party) via the help of an identity provider.
   The purpose of this system is to provide a way to verify that an end
   user controls an identifier.

   Simple Authentication and Security Layer (SASL) [RFC4422] is used by