Simple Authentication and Security Layer

Simple Authentication and Security Layer (SASL) is a framework for authentication and data security in Internet protocols. It decouples authentication mechanisms from application protocols, in theory allowing any authentication mechanism supported by SASL to be used in any application protocol that uses SASL. Authentication mechanisms can also support proxy authorization, a facility allowing one user to assume the identity of another. They can also provide a data security layer offering data integrity and data confidentiality services. DIGEST-MD5 provides an example of mechanisms which can provide a data-security layer. Application protocols that support SASL typically also support Transport Layer Security (TLS) to complement the services offered by SASL.

John Gardiner Myers wrote the original SASL specification (RFC 2222) in 1997 while at Carnegie Mellon University. In 2006, that document was made obsolete by RFC 4422 authored by Alexey Melnikov and Kurt D. Zeilenga. SASL, as defined by RFC 4422 is an IETF Standard Track protocol and is, as of 2006, a Proposed Standard.

SASL mechanisms

A SASL mechanism implements a series of challenges and responses. Defined SASL mechanisms[1] include:

The GS2 family of mechanisms supports arbitrary GSS-API mechanisms in SASL.[6] It is now standardized as RFC 5801.

SASL-aware application protocols

Application protocols define their representation of SASL exchanges with a profile. A protocol has a service name such as "ldap" in a registry shared with GSSAPI and Kerberos.[7]

As of 2012 protocols currently supporting SASL include:

See also

References

  1. ↑ "Simple Authentication and Security Layer (SASL) Mechanisms". iana.org.
  2. ↑ RFC 6331
  3. ↑ Luke Howard. "A SASL and GSS-API Mechanism for the BrowserID Authentication Protocol".
  4. ↑ Sam Hartman. "A GSS-API Mechanism for the Extensible Authentication Protocol".
  5. ↑ A Set of Simple Authentication and Security Layer (SASL) Mechanisms for OAuth. IETF. August 2015. RFC 7628. https://tools.ietf.org/html/rfc7628. Retrieved October 7, 2016.
  6. ↑ Simon Josefsson. "Using GSS-API Mechanisms in SASL: The GS2 Mechanism Family".
  7. ↑ "Generic Security Service Application Program Interface (GSSAPI)/Kerberos/Simple Authentication and Security Layer (SASL) Service Names". iana.org.
  8. ↑ "Request for allocation of new security type code for SASL auth". realvnc.com.
  1. ↑ Bartlett, Andrew (2005-04-25). "GENSEC - Designing a security subsystem" (PDF). p. 4. Retrieved 2010-03-28. The idea of a generic security API is not new [...] to implement, by some mechanism or other, a wide variety of these protocols, including SASL, GSS-API, SPNEGO as well as the proprietary NTLMSSP [...] in the wider open source world we see individual applications introduce similar abstraction layers, or adopt the Open Source Cyrus-SASL library to provide one.
This article is issued from Wikipedia - version of the 10/7/2016. The text is available under the Creative Commons Attribution/Share Alike but additional terms may apply for the media files.