From ae5d1eecf7f502fd1fdd717eaa3e72dcf016ac87 Mon Sep 17 00:00:00 2001 From: Peter Saint-Andre Date: Tue, 6 Feb 2007 22:59:49 +0000 Subject: [PATCH] 0.7 git-svn-id: file:///home/ksmith/gitmigration/svn/xmpp/trunk@499 4b5297f7-1745-476d-ba37-a9c6900126ab --- xep-0178.xml | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/xep-0178.xml b/xep-0178.xml index 7c19cddb..a7a3c14f 100644 --- a/xep-0178.xml +++ b/xep-0178.xml @@ -6,8 +6,8 @@
- Best Practices for Use of SASL EXTERNAL - This document specifies best practices for use of the SASL EXTERNAL mechanism within XMPP. + Best Practices for Use of SASL EXTERNAL with Certificates + This document specifies best practices for XMPP usage of the SASL EXTERNAL mechanism in the context of X.509 certificates. &LEGALNOTICE; 0178 Proposed @@ -22,6 +22,12 @@ N/A &stpeter; &pgmillard; + + 0.7 + 2007-02-06 + psa +

Clarified that the scope of this specification is limited to X.509 certificates.

 + 0.6 2007-01-29 @@ -78,12 +84,10 @@
- &RFC3920BISNOTE; -

RFC 3920 allows the use of any SASL mechanism (see &rfc4422;) in XMPP authentication, including the SASL EXTERNAL mechanism. This document specifies a recommended protocol flow for such use, specifically when negotiation of TLS is required by a deployment. The protocol flows when TLS is not required are more complicated (e.g., alternate flows involving server dialback) and may be described in a future version of this document.

-

Note: This specification focuses on the use of the SASL EXTERNAL mechanism with X.509 certificates. A future version of this specification may document best practices for use of SASL EXTERNAL outside the context of the X.509 infrastructure, for example via Internet Protocol Security (IPSec) as specified in &rfc4301;.

+

XMPP as specified in &rfc3920; and provisionally clarified in &rfc3920bis; allows the use of any SASL mechanism (see &rfc4422;) in the authentication of XMPP entities, including the SASL EXTERNAL mechanism. This document specifies a recommended protocol flow for such use in the context of X.509 certificates, specifically when negotiation of TLS is required by a deployment. The protocol flows when TLS is not required are more complicated (e.g., alternate flows involving server dialback) and may be described in a future version of this document. This specification focuses on the use of the SASL EXTERNAL mechanism with X.509 certificates. Future specifications may document best practices for use of SASL EXTERNAL outside the context of the X.509 infrastructure, for example via Internet Protocol Security (IPSec) as specified in &rfc4301;.

 -

As specified in RFC 3920, if a JabberID is included in an X.509 certificate, it MUST be encapsulated as an id-on-xmppAddr Object Identifier. Although it is not necessary for an X.509 certificate to include a JabberID, it is RECOMMENDED that client certificates include at least one id-on-xmppAddr OID encapsulating the JabberID of associated user (e.g., "juliet@example.org"), and OPTIONAL for client certificates to include either more than one id-on-xmppAddr or no id-on-xmppAddr. This specification includes recommendations that address all three cases.

+

As specified in RFC 3920 and provisionally clarified in rfc3920bis, if a JabberID is included in an X.509 certificate, it MUST be encapsulated as an id-on-xmppAddr Object Identifier. Although it is not necessary for an X.509 certificate to include a JabberID, it is RECOMMENDED that client certificates include at least one id-on-xmppAddr OID encapsulating the JabberID of associated user (e.g., "juliet@example.org"), and OPTIONAL for client certificates to include either more than one id-on-xmppAddr or no id-on-xmppAddr. This specification includes recommendations that address all three cases.

The RECOMMENDED protocol flow for client-to-server use of SASL EXTERNAL with end-user certificates is as follows:

  1. @@ -222,7 +226,7 @@
-

As specified in RFC 3920, if a JabberID is included in an X.509 certificate, it MUST be encapsulated as an id-on-xmppAddr Object Identifier. Although it is not necessary for an X.509 certificate to include a JabberID, it is RECOMMENDED that server certificates include the id-on-xmppAddr OID encapsulating the JabberID of the bare XMPP server domain only (e.g., "example.org"). In addition, it is RECOMMENDED in the case of server certificates for the server's hostname to be encapsulated as a subjectAltName extension of type dNSName. Furthermore it is quite common for XMPP servers to also offer associated services as subdomains of the server; if a server offers such services then it is RECOMMENDED to either include an id-on-xmppAddr OID for each subdomain or to include a dnsName containing the wildcard character '*' applying to the left-most domain name component or component fragment (this is considered to match any single component or component fragment, e.g., *.example.org matches foo.example.org but not bar.foo.example.org, and im*.example.net matches im1.example.net and im2.example.net but not chat.example.net). This specification includes recommendations that address all three cases.

+

As specified in RFC 3920 and provisionally clarified in rfc3920bis, if a JabberID is included in an X.509 certificate, it MUST be encapsulated as an id-on-xmppAddr Object Identifier. Although it is not necessary for an X.509 certificate to include a JabberID, it is RECOMMENDED that server certificates include the id-on-xmppAddr OID encapsulating the JabberID of the bare XMPP server domain only (e.g., "example.org"). In addition, it is RECOMMENDED in the case of server certificates for the server's hostname to be encapsulated as a subjectAltName extension of type dNSName. Furthermore it is quite common for XMPP servers to also offer associated services as subdomains of the server; if a server offers such services then it is RECOMMENDED to either include an id-on-xmppAddr OID for each subdomain or to include a dnsName containing the wildcard character '*' applying to the left-most domain name component or component fragment (this is considered to match any single component or component fragment, e.g., *.example.org matches foo.example.org but not bar.foo.example.org, and im*.example.net matches im1.example.net and im2.example.net but not chat.example.net). This specification includes recommendations that address all three cases.

The RECOMMENDED protocol flow for server-to-server use of SASL EXTERNAL with server (domain) certificates is as follows: