This document specifies best practices for use of the SASL ANONYMOUS mechanism in the context of client authentication with an XMPP server.
NOTICE: This JEP is currently within Last Call or under consideration by the Jabber Council for advancement to the next stage in the JSF standards process. For further details, visit <http://www.jabber.org/council/queue.shtml>.
Status:
Proposed
Type:
Informational
Number: 0175
Version: 0.1
Last Updated: 2006-02-09
JIG: Standards JIG
Approving Body: Jabber Council
Dependencies: XMPP Core
Supersedes: None
Superseded By: None
Short Name: N/A
Wiki Page: <http://wiki.jabber.org/index.php/Best Practices for Use of SASL ANONYMOUS (JEP-0175)>
Email:
stpeter@jabber.org
JID:
stpeter@jabber.org
This Jabber Enhancement Proposal is copyright 1999 - 2006 by the Jabber Software Foundation (JSF) and is in full conformance with the JSF's Intellectual Property Rights Policy <http://www.jabber.org/jsf/ipr-policy.shtml>. This material may be distributed only subject to the terms and conditions set forth in the Creative Commons Attribution License (<http://creativecommons.org/licenses/by/2.5/>).
The preferred venue for discussion of this document is the Standards-JIG discussion list: <http://mail.jabber.org/mailman/listinfo/standards-jig>.
The Extensible Messaging and Presence Protocol (XMPP) is defined in the XMPP Core (RFC 3920) and XMPP IM (RFC 3921) specifications contributed by the Jabber Software Foundation to the Internet Standards Process, which is managed by the Internet Engineering Task Force in accordance with RFC 2026. Any protocol defined in this JEP has been developed outside the Internet Standards Process and is to be understood as an extension to XMPP rather than as an evolution, development, or modification of XMPP itself.
The following keywords as used in this document are to be interpreted as described in RFC 2119: "MUST", "SHALL", "REQUIRED"; "MUST NOT", "SHALL NOT"; "SHOULD", "RECOMMENDED"; "SHOULD NOT", "NOT RECOMMENDED"; "MAY", "OPTIONAL".
Note: This document describes a protocol or best practice that is intended for addition to the specification that will supersede either RFC 3920 [1] or RFC 3921 [2] within the Internet Standards Process. This document is provided only for the purpose of open community discussion of the potential modification and will be obsoleted as soon as the relevant RFC is published.
RFC 3920 allows the use of any SASL mechanism (see RFC 4422 [3]) in XMPP authentication, including the SASL ANONYMOUS mechanism (see RFC 4505 [4]). This document specifies a recommended protocol flow for such use.
Note: This document is provided for discussion purposes in order to clarify the usage of SASL ANONYMOUS in XMPP systems. It is not meant to supersede the text in RFC 3920, RFC 4422, or RFC 4505. However, the recommendations in this document may be folded into rfc3920bis when that document is written.
RFC 3920 specifies that after an XMPP client authenticates with an XMPP server, it must bind a resource to the XML stream so that XML stanzas can be routed to the client. In essence there are three resource binding scenarios:
No matter which scenario is enacted, at the end of the process the server informs the client of its full JID (<node@domain.tld/resource>). In particular, it might be helpful for an XMPP server to assign a full JID to the client (i.e., not just the resource identifier) if it authenticates with SASL ANONYMOUS, and to ensure that the "bare JID" portion (<node@domain.tld>) is unique in the context of the domain served by the server.
The RECOMMENDED protocol flow following TLS negotiation (refer to RFC 3920) is as follows:
Client initiates stream to server.
<stream:stream xmlns:stream='http://etherx.jabber.org/streams' xmlns='jabber:client' to='example.com' version='1.0'>
Server replies with stream header.
<stream:stream xmlns:stream='http://etherx.jabber.org/streams' xmlns='jabber:client' id='c2s_234' from='example.com' version='1.0'>
Server advertises stream features.
<stream:features> <mechanisms xmlns='urn:ietf:params:xml:ns:xmpp-sasl'> <mechanism>DIGEST-MD5<mechanism> <mechanism>ANONYMOUS<mechanism> </mechanisms> </stream:features>
Client requests SASL ANONYMOUS mechanism.
<auth xmlns='urn:ietf:params:xml:ns:xmpp-sasl' mechanism='ANONYMOUS'/>
Server sends <success/>.
<success xmlns='urn:ietf:params:xml:ns:xmpp-sasl'/>
Client opens new stream.
<stream:stream xmlns:stream='http://etherx.jabber.org/streams' xmlns='jabber:client' to='example.com' version='1.0'>
Server tells client that resource binding is required.
<stream:stream xmlns:stream='http://etherx.jabber.org/streams' xmlns='jabber:client' id='c2s_345' from='example.com' version='1.0'> <stream:features> <bind xmlns='urn:ietf:params:xml:ns:xmpp-bind'/> </stream:features>
Client requests that server create a resource for it.
<iq type='set' id='bind_1'> <bind xmlns='urn:ietf:params:xml:ns:xmpp-bind'/> </iq>
Server replies with full JID.
<iq type='result' id='bind_1'> <bind xmlns='urn:ietf:params:xml:ns:xmpp-bind'> <jid>somenode@example.com/someresource</jid> </bind> </iq>
This JEP introduces no security considerations or concerns above and beyond those discussed in RFC 3920.
This JEP requires no interaction with the Internet Assigned Numbers Authority (IANA) [5].
This JEP requires no interaction with the Jabber Registrar [6].
1. RFC 3920: Extensible Messaging and Presence Protocol (XMPP): Core <http://www.ietf.org/rfc/rfc3920.txt>.
2. RFC 3921: Extensible Messaging and Presence Protocol (XMPP): Instant Messaging and Presence <http://www.ietf.org/rfc/rfc3921.txt>.
3. RFC 4422: Simple Authentication and Security Layer (SASL) <http://www.ietf.org/rfc/rfc4422.txt>.
4. RFC 4505: The SASL ANONYMOUS Mechanism <http://www.ietf.org/rfc/rfc4505.txt>.
5. The Internet Assigned Numbers Authority (IANA) is the central coordinator for the assignment of unique parameter values for Internet protocols, such as port numbers and URI schemes. For further information, see <http://www.iana.org/>.
6. The Jabber Registrar maintains a list of reserved Jabber protocol namespaces as well as registries of parameters used in the context of protocols approved by the Jabber Software Foundation. For further information, see <http://www.jabber.org/registrar/>.
Initial JEP version; modified flow to remove unecessary challenge.
(psa)First draft.
(psa)END