Subject: [RESEND] Re: Sasl service name

From: Chris Newman <[email-masked]>
Date: Tue, 03 Apr 2001 15:46:42 -0700

The official registry for service names is at:
  <http://www.isi.edu/in-notes/iana/assignments/gssapi-service-names>

"imap" and "pop" are registered.
"smtp" is defined in RFC 2554 (and I just reminded IANA to register it),
note that it only effectively applies to authenticated SMTP.

NNTP doesn't have a finalized spec for authentication yet, but the most
recent draft uses "news" as the service name, so that's what will be
registered once the draft is finalized unless there are objections (the
draft will be reviewed by the NNTP extensions WG).

Certain SASL mechanisms require the use of service names, including:
  * Kerberos 5 (GSSAPI)      RFC 2222
  * Kerberos 4 (KERBEROS_V4) RFC 2222
  * DIGEST-MD5               RFC 2831
Kerberos 5 also defines the concept of the "host" service name as a
catch-all.  Kerberos 4 implementations often use "rcmd" as a catch-all.

The theory behind service names is that one can use different tickets for
different services so that granting a user access to one service on a given
host doesn't automatically grant them access to all services on that host.

You'll have to ask Mark Crispin about the APIs used between the c-client
SASL layer and the c-client library, as well as how they provide for
service names.

		- Chris