XSF Discussion - 2018-06-15

there is not MAM on mux.xmpp.org yet ?

another question, why a pubsub service disco#info returns pubsub-service and a conference service disco#fino return conference-text

edhelas, I've no idea. I don't think in most cases the disco identities were ever that well thought through.

edhelas, I mean, I've no idea what advantage there is in making MIX give out conference/text as well, or if there's a risk involved.

edhelas, But I have to say I like disco#fino. We should make one of those.

:p

no but I'd expect to have all the services declared as services

conference/service for MUC and MIX? That probably makes some sense. Or would have had we done things that way.

then I can more easily differenciate what are info coming from services and from muc

same for pubsub actually

WHat do you do with the identity though?

it's basically to store things in the db, and to trigger some more disco#items request sometimes

Could SASL mechanisms other than ANONYMOUS be used to establish anonymous logins? Akin to one-time passwords, perhaps?

Of course

Is there a generic concept there? Any mechanism that succeeds, but doesn't result in an authzid, something like that?

I'm not sure what you mean. Are you talking about re-using PLAIN? or custom mechanisms?

I find EXTERNAL useful, for example I use it with BOSH/websockets for cookie auth

something like OAUTHBEARER with a token - could be EXTERNAL too, I guess.

I'm wondering about limited time access kind of tokens.

SCRAM could result in an anonymous login, mind. Any SASL mechanism results in an authzid - ANONYMOUS is just special in not having an authcid.

Dave, we miss you in open_chat 🙂

SCRAM has a concept of anonymous logins? How does that work?

Dave Cridland, what’s the authcid? I fail to find the definition in SASL or SCRAM either

is that defined in the using protocol?

(I remember having seen it before)

(but it’s not in RFC 6120 either) ✏

SamWhited, SCRAM has no concept itself. But if one assumes that an anonymous user is simply one with a possibly ephemeral authzid that has some special property, then there's no reason you can't get one of those by authenticating with SCRAM.

jonasw, AUTHentiCation IDentifier. Or loosely, what the mechanism uses as the username. There's always been some question of whether PKIX's authcid is the certificate or not, which is why I say "loosely" - it gets a bit philosophical after a while.

ahhh

right

jonasw, Whereas the authzid is - for us - always a JID.

authzid is what you’re authorized to used after you’ve been authenticated, r ight

so what one would do is to use an ephemeral authcid (or a special one which indicates anonymous thing) and then SCRAM or PLAIN with a one-time token as password ✏

one would then still have to specify how the client knows which bare JID it gets, if it wants to bind. but that could be in ephemeral authcid if there’s a way to communicate that out-of-band

jonasw, The client is told its jid during bind, mind. It doesn't use it until afterward.

jonasw, In SASL2, though, it gets told the authzid explicitly in the <success/>.

jonasw, Also, for amusement, this is how anonymous FTP works.

oh right, the client doesn’t even need to know the bare JID, I forgot that

Dave Cridland, ha, history repeats itself :)

Is there nice tooling for exploring graphs?