| draft-ietf-httpbis-p7-auth-15.txt |  | draft-ietf-httpbis-p7-auth-16.txt |
--- | --- | --- | --- | ---
| HTTPbis Working Group R. Fielding, Ed. |  | HTTPbis Working Group R. Fielding, Ed. |
| Internet-Draft Adobe |  | Internet-Draft Adobe |
| Obsoletes: 2616 (if approved) J. Gettys |  | Obsoletes: 2616 (if approved) J. Gettys |
| Updates: 2617 (if approved) Alcatel-Lucent |  | Updates: 2617 (if approved) Alcatel-Lucent |
| Intended status: Standards Track J. Mogul |  | Intended status: Standards Track J. Mogul |
| Expires: January 12, 2012 HP |  | Expires: February 25, 2012 HP |
| H. Frystyk |  | H. Frystyk |
| Microsoft |  | Microsoft |
| L. Masinter |  | L. Masinter |
| Adobe |  | Adobe |
| P. Leach |  | P. Leach |
| Microsoft |  | Microsoft |
| T. Berners-Lee |  | T. Berners-Lee |
| W3C/MIT |  | W3C/MIT |
| Y. Lafon, Ed. |  | Y. Lafon, Ed. |
| W3C |  | W3C |
| J. Reschke, Ed. |  | J. Reschke, Ed. |
| greenbytes |  | greenbytes |
| July 11, 2011 |  | August 24, 2011 |
| HTTP/1.1, part 7: Authentication |  | HTTP/1.1, part 7: Authentication |
| draft-ietf-httpbis-p7-auth-15 |  | draft-ietf-httpbis-p7-auth-16 |
| Abstract |  | Abstract |
| The Hypertext Transfer Protocol (HTTP) is an application-level |  | The Hypertext Transfer Protocol (HTTP) is an application-level |
| protocol for distributed, collaborative, hypermedia information |  | protocol for distributed, collaborative, hypermedia information |
| systems. HTTP has been in use by the World Wide Web global |  | systems. HTTP has been in use by the World Wide Web global |
| information initiative since 1990. This document is Part 7 of the |  | information initiative since 1990. This document is Part 7 of the |
| seven-part specification that defines the protocol referred to as |  | seven-part specification that defines the protocol referred to as |
| "HTTP/1.1" and, taken together, obsoletes RFC 2616. Part 7 defines |  | "HTTP/1.1" and, taken together, obsoletes RFC 2616. |
| HTTP Authentication. |  |  |
|  |  | Part 7 defines the HTTP Authentication framework. |
| Editorial Note (To be removed by RFC Editor) |  | Editorial Note (To be removed by RFC Editor) |
| Discussion of this draft should take place on the HTTPBIS working |  | Discussion of this draft should take place on the HTTPBIS working |
| group mailing list (ietf-http-wg@w3.org), which is archived at |  | group mailing list (ietf-http-wg@w3.org), which is archived at |
| <http://lists.w3.org/Archives/Public/ietf-http-wg/>. |  | <http://lists.w3.org/Archives/Public/ietf-http-wg/>. |
| The current issues list is at |  | The current issues list is at |
| <http://tools.ietf.org/wg/httpbis/trac/report/3> and related |  | <http://tools.ietf.org/wg/httpbis/trac/report/3> and related |
| documents (including fancy diffs) can be found at |  | documents (including fancy diffs) can be found at |
| <http://tools.ietf.org/wg/httpbis/>. |  | <http://tools.ietf.org/wg/httpbis/>. |
| The changes in this draft are summarized in Appendix C.16. |  | The changes in this draft are summarized in Appendix C.17. |
| Status of This Memo |  | Status of This Memo |
| This Internet-Draft is submitted in full conformance with the |  | This Internet-Draft is submitted in full conformance with the |
| provisions of BCP 78 and BCP 79. |  | provisions of BCP 78 and BCP 79. |
| Internet-Drafts are working documents of the Internet Engineering |  | Internet-Drafts are working documents of the Internet Engineering |
| Task Force (IETF). Note that other groups may also distribute |  | Task Force (IETF). Note that other groups may also distribute |
| working documents as Internet-Drafts. The list of current Internet- |  | working documents as Internet-Drafts. The list of current Internet- |
| Drafts is at http://datatracker.ietf.org/drafts/current/. |  | Drafts is at http://datatracker.ietf.org/drafts/current/. |
| Internet-Drafts are draft documents valid for a maximum of six months |  | Internet-Drafts are draft documents valid for a maximum of six months |
| and may be updated, replaced, or obsoleted by other documents at any |  | and may be updated, replaced, or obsoleted by other documents at any |
| skipping to change at page 2, line 17 |  | skipping to change at page 2, line 20 |
| Internet-Drafts are working documents of the Internet Engineering |  | Internet-Drafts are working documents of the Internet Engineering |
| Task Force (IETF). Note that other groups may also distribute |  | Task Force (IETF). Note that other groups may also distribute |
| working documents as Internet-Drafts. The list of current Internet- |  | working documents as Internet-Drafts. The list of current Internet- |
| Drafts is at http://datatracker.ietf.org/drafts/current/. |  | Drafts is at http://datatracker.ietf.org/drafts/current/. |
| Internet-Drafts are draft documents valid for a maximum of six months |  | Internet-Drafts are draft documents valid for a maximum of six months |
| and may be updated, replaced, or obsoleted by other documents at any |  | and may be updated, replaced, or obsoleted by other documents at any |
| time. It is inappropriate to use Internet-Drafts as reference |  | time. It is inappropriate to use Internet-Drafts as reference |
| material or to cite them other than as "work in progress." |  | material or to cite them other than as "work in progress." |
| This Internet-Draft will expire on January 12, 2012. |  | This Internet-Draft will expire on February 25, 2012. |
| Copyright Notice |  | Copyright Notice |
| Copyright (c) 2011 IETF Trust and the persons identified as the |  | Copyright (c) 2011 IETF Trust and the persons identified as the |
| document authors. All rights reserved. |  | document authors. All rights reserved. |
| This document is subject to BCP 78 and the IETF Trust's Legal |  | This document is subject to BCP 78 and the IETF Trust's Legal |
| Provisions Relating to IETF Documents |  | Provisions Relating to IETF Documents |
| (http://trustee.ietf.org/license-info) in effect on the date of |  | (http://trustee.ietf.org/license-info) in effect on the date of |
| publication of this document. Please review these documents |  | publication of this document. Please review these documents |
| skipping to change at page 3, line 12 |  | skipping to change at page 3, line 7 |
| it for publication as an RFC or to translate it into languages other |  | it for publication as an RFC or to translate it into languages other |
| than English. |  | than English. |
| Table of Contents |  | Table of Contents |
| 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 4 |  | 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 4 |
| 1.1. Requirements . . . . . . . . . . . . . . . . . . . . . . . 4 |  | 1.1. Requirements . . . . . . . . . . . . . . . . . . . . . . . 4 |
| 1.2. Syntax Notation . . . . . . . . . . . . . . . . . . . . . 4 |  | 1.2. Syntax Notation . . . . . . . . . . . . . . . . . . . . . 4 |
| 1.2.1. Core Rules . . . . . . . . . . . . . . . . . . . . . . 4 |  | 1.2.1. Core Rules . . . . . . . . . . . . . . . . . . . . . . 4 |
| 2. Access Authentication Framework . . . . . . . . . . . . . . . 5 |  | 2. Access Authentication Framework . . . . . . . . . . . . . . . 5 |
| 2.1. Authentication Scheme Registry . . . . . . . . . . . . . . 7 |  | 2.1. Challenge and Response . . . . . . . . . . . . . . . . . . 5 |
| 3. Status Code Definitions . . . . . . . . . . . . . . . . . . . 7 |  | 2.2. Protection Space (Realm) . . . . . . . . . . . . . . . . . 7 |
| 3.1. 401 Unauthorized . . . . . . . . . . . . . . . . . . . . . 7 |  | 2.3. Authentication Scheme Registry . . . . . . . . . . . . . . 7 |
| 3.2. 407 Proxy Authentication Required . . . . . . . . . . . . 7 |  | 2.3.1. Considerations for New Authentication Schemes . . . . 8 |
| 4. Header Field Definitions . . . . . . . . . . . . . . . . . . . 8 |  | 3. Status Code Definitions . . . . . . . . . . . . . . . . . . . 8 |
| 4.1. Authorization . . . . . . . . . . . . . . . . . . . . . . 8 |  | 3.1. 401 Unauthorized . . . . . . . . . . . . . . . . . . . . . 8 |
| 4.2. Proxy-Authenticate . . . . . . . . . . . . . . . . . . . . 9 |  | 3.2. 407 Proxy Authentication Required . . . . . . . . . . . . 9 |
| 4.3. Proxy-Authorization . . . . . . . . . . . . . . . . . . . 9 |  | 4. Header Field Definitions . . . . . . . . . . . . . . . . . . . 9 |
| 4.4. WWW-Authenticate . . . . . . . . . . . . . . . . . . . . . 9 |  | 4.1. Authorization . . . . . . . . . . . . . . . . . . . . . . 9 |
| 5. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 10 |  | 4.2. Proxy-Authenticate . . . . . . . . . . . . . . . . . . . . 10 |
| 5.1. Authenticaton Scheme Registry . . . . . . . . . . . . . . 10 |  | 4.3. Proxy-Authorization . . . . . . . . . . . . . . . . . . . 10 |
| 5.2. Status Code Registration . . . . . . . . . . . . . . . . . 10 |  | 4.4. WWW-Authenticate . . . . . . . . . . . . . . . . . . . . . 11 |
| 5.3. Header Field Registration . . . . . . . . . . . . . . . . 10 |  | 5. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 11 |
| 6. Security Considerations . . . . . . . . . . . . . . . . . . . 10 |  | 5.1. Authenticaton Scheme Registry . . . . . . . . . . . . . . 11 |
| 6.1. Authentication Credentials and Idle Clients . . . . . . . 11 |  | 5.2. Status Code Registration . . . . . . . . . . . . . . . . . 11 |
| 7. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 11 |  | 5.3. Header Field Registration . . . . . . . . . . . . . . . . 11 |
| 8. References . . . . . . . . . . . . . . . . . . . . . . . . . . 11 |  | 6. Security Considerations . . . . . . . . . . . . . . . . . . . 12 |
| 8.1. Normative References . . . . . . . . . . . . . . . . . . . 11 |  | 6.1. Authentication Credentials and Idle Clients . . . . . . . 12 |
| 8.2. Informative References . . . . . . . . . . . . . . . . . . 12 |  | 7. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 13 |
| Appendix A. Changes from RFC 2616 . . . . . . . . . . . . . . . . 12 |  | 8. References . . . . . . . . . . . . . . . . . . . . . . . . . . 13 |
| Appendix B. Collected ABNF . . . . . . . . . . . . . . . . . . . 13 |  | 8.1. Normative References . . . . . . . . . . . . . . . . . . . 13 |
|  |  | 8.2. Informative References . . . . . . . . . . . . . . . . . . 13 |
|  |  | Appendix A. Changes from RFCs 2616 and 2617 . . . . . . . . . . . 14 |
|  |  | Appendix B. Collected ABNF . . . . . . . . . . . . . . . . . . . 15 |
| Appendix C. Change Log (to be removed by RFC Editor before |  | Appendix C. Change Log (to be removed by RFC Editor before |
| publication) . . . . . . . . . . . . . . . . . . . . 13 |  | publication) . . . . . . . . . . . . . . . . . . . . 15 |
| C.1. Since RFC 2616 . . . . . . . . . . . . . . . . . . . . . . 13 |  | C.1. Since RFC 2616 . . . . . . . . . . . . . . . . . . . . . . 15 |
| C.2. Since draft-ietf-httpbis-p7-auth-00 . . . . . . . . . . . 13 |  | C.2. Since draft-ietf-httpbis-p7-auth-00 . . . . . . . . . . . 16 |
| C.3. Since draft-ietf-httpbis-p7-auth-01 . . . . . . . . . . . 14 |  | C.3. Since draft-ietf-httpbis-p7-auth-01 . . . . . . . . . . . 16 |
| C.4. Since draft-ietf-httpbis-p7-auth-02 . . . . . . . . . . . 14 |  | C.4. Since draft-ietf-httpbis-p7-auth-02 . . . . . . . . . . . 16 |
| C.5. Since draft-ietf-httpbis-p7-auth-03 . . . . . . . . . . . 14 |  | C.5. Since draft-ietf-httpbis-p7-auth-03 . . . . . . . . . . . 16 |
| C.6. Since draft-ietf-httpbis-p7-auth-04 . . . . . . . . . . . 14 |  | C.6. Since draft-ietf-httpbis-p7-auth-04 . . . . . . . . . . . 16 |
| C.7. Since draft-ietf-httpbis-p7-auth-05 . . . . . . . . . . . 14 |  | C.7. Since draft-ietf-httpbis-p7-auth-05 . . . . . . . . . . . 16 |
| C.8. Since draft-ietf-httpbis-p7-auth-06 . . . . . . . . . . . 14 |  | C.8. Since draft-ietf-httpbis-p7-auth-06 . . . . . . . . . . . 17 |
| C.9. Since draft-ietf-httpbis-p7-auth-07 . . . . . . . . . . . 15 |  | C.9. Since draft-ietf-httpbis-p7-auth-07 . . . . . . . . . . . 17 |
| C.10. Since draft-ietf-httpbis-p7-auth-08 . . . . . . . . . . . 15 |  | C.10. Since draft-ietf-httpbis-p7-auth-08 . . . . . . . . . . . 17 |
| C.11. Since draft-ietf-httpbis-p7-auth-09 . . . . . . . . . . . 15 |  | C.11. Since draft-ietf-httpbis-p7-auth-09 . . . . . . . . . . . 17 |
| C.12. Since draft-ietf-httpbis-p7-auth-10 . . . . . . . . . . . 15 |  | C.12. Since draft-ietf-httpbis-p7-auth-10 . . . . . . . . . . . 17 |
| C.13. Since draft-ietf-httpbis-p7-auth-11 . . . . . . . . . . . 15 |  | C.13. Since draft-ietf-httpbis-p7-auth-11 . . . . . . . . . . . 17 |
| C.14. Since draft-ietf-httpbis-p7-auth-12 . . . . . . . . . . . 15 |  | C.14. Since draft-ietf-httpbis-p7-auth-12 . . . . . . . . . . . 18 |
| C.15. Since draft-ietf-httpbis-p7-auth-13 . . . . . . . . . . . 16 |  | C.15. Since draft-ietf-httpbis-p7-auth-13 . . . . . . . . . . . 18 |
| C.16. Since draft-ietf-httpbis-p7-auth-14 . . . . . . . . . . . 16 |  | C.16. Since draft-ietf-httpbis-p7-auth-14 . . . . . . . . . . . 18 |
| Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 |  | C.17. Since draft-ietf-httpbis-p7-auth-15 . . . . . . . . . . . 18 |
|  |  | Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 |
| 1. Introduction |  | 1. Introduction |
| This document defines HTTP/1.1 access control and authentication. It |  | This document defines HTTP/1.1 access control and authentication. It |
| includes the relevant parts of RFC 2616 with only minor changes, plus |  | includes the relevant parts of RFC 2616 with only minor changes, plus |
| the general framework for HTTP authentication, as previously defined |  | the general framework for HTTP authentication, as previously defined |
| in "HTTP Authentication: Basic and Digest Access Authentication" |  | in "HTTP Authentication: Basic and Digest Access Authentication" |
| ([RFC2617]). |  | ([RFC2617]). |
| HTTP provides several OPTIONAL challenge-response authentication |  | HTTP provides several OPTIONAL challenge-response authentication |
| skipping to change at page 4, line 50 |  | skipping to change at page 4, line 50 |
| The following core rules are included by reference, as defined in |  | The following core rules are included by reference, as defined in |
| [RFC5234], Appendix B.1: ALPHA (letters), CR (carriage return), CRLF |  | [RFC5234], Appendix B.1: ALPHA (letters), CR (carriage return), CRLF |
| (CR LF), CTL (controls), DIGIT (decimal 0-9), DQUOTE (double quote), |  | (CR LF), CTL (controls), DIGIT (decimal 0-9), DQUOTE (double quote), |
| HEXDIG (hexadecimal 0-9/A-F/a-f), LF (line feed), OCTET (any 8-bit |  | HEXDIG (hexadecimal 0-9/A-F/a-f), LF (line feed), OCTET (any 8-bit |
| sequence of data), SP (space), VCHAR (any visible USASCII character), |  | sequence of data), SP (space), VCHAR (any visible USASCII character), |
| and WSP (whitespace). |  | and WSP (whitespace). |
| 1.2.1. Core Rules |  | 1.2.1. Core Rules |
| The core rules below are defined in Section 1.2.2 of [Part1]: |  | The core rules below are defined in [Part1]: |
| quoted-string = <quoted-string, defined in [Part1], Section 1.2.2> |  | BWS = <BWS, defined in [Part1], Section 1.2.2> |
| token = <token, defined in [Part1], Section 1.2.2> |  |  |
| OWS = <OWS, defined in [Part1], Section 1.2.2> |  | OWS = <OWS, defined in [Part1], Section 1.2.2> |
|  |  | quoted-string = <quoted-string, defined in [Part1], Section 3.2.3> |
|  |  | token = <token, defined in [Part1], Section 3.2.3> |
| 2. Access Authentication Framework |  | 2. Access Authentication Framework |
|  |  | 2.1. Challenge and Response |
| HTTP provides a simple challenge-response authentication mechanism |  | HTTP provides a simple challenge-response authentication mechanism |
| that can be used by a server to challenge a client request and by a |  | that can be used by a server to challenge a client request and by a |
| client to provide authentication information. It uses an extensible, |  | client to provide authentication information. It uses an extensible, |
| case-insensitive token to identify the authentication scheme, |  | case-insensitive token to identify the authentication scheme, |
| followed by a comma-separated list of attribute-value pairs which |  | followed by additional information necessary for achieving |
| carry the parameters necessary for achieving authentication via that |  | authentication via that scheme. The latter can either be a comma- |
| scheme. |  | separated list of attribute-value pairs or a single sequence of |
|  |  | characters capable of holding base64-encoded information. |
| auth-scheme = token |  | auth-scheme = token |
| auth-param = token "=" ( token / quoted-string ) |  |  |
|  |  | auth-param = token BWS "=" BWS ( token / quoted-string ) |
|  |  | b64token = 1*( ALPHA / DIGIT / |
|  |  | "-" / "." / "_" / "~" / "+" / "/" ) *"=" |
|  |  | The "b64token" syntax allows the 66 unreserved URI characters |
|  |  | ([RFC3986]), plus a few others, so that it can hold a base64, |
|  |  | base64url (URL and filename safe alphabet), base32, or base16 (hex) |
|  |  | encoding, with or without padding, but excluding whitespace |
|  |  | ([RFC4648]). |
| The 401 (Unauthorized) response message is used by an origin server |  | The 401 (Unauthorized) response message is used by an origin server |
| to challenge the authorization of a user agent. This response MUST |  | to challenge the authorization of a user agent. This response MUST |
| include a WWW-Authenticate header field containing at least one |  | include a WWW-Authenticate header field containing at least one |
| challenge applicable to the requested resource. The 407 (Proxy |  | challenge applicable to the requested resource. |
| Authentication Required) response message is used by a proxy to |  |  |
| challenge the authorization of a client and MUST include a Proxy- |  | The 407 (Proxy Authentication Required) response message is used by a |
| Authenticate header field containing at least one challenge |  | proxy to challenge the authorization of a client and MUST include a |
|  |  | Proxy-Authenticate header field containing at least one challenge |
| applicable to the proxy for the requested resource. |  | applicable to the proxy for the requested resource. |
| challenge = auth-scheme 1*SP 1#auth-param |  | challenge = auth-scheme [ 1*SP ( b64token / #auth-param ) ] |
| Note: User agents will need to take special care in parsing the |  | Note: User agents will need to take special care in parsing the |
| WWW-Authenticate or Proxy-Authenticate header field value if it |  | WWW-Authenticate and Proxy-Authenticate header field values |
| contains more than one challenge, or if more than one WWW- |  | because they can contain more than one challenge, or if more than |
| Authenticate header field is provided, since the contents of a |  | one of each is provided, since the contents of a challenge can |
| challenge can itself contain a comma-separated list of |  | itself contain a comma-separated list of authentication |
| authentication parameters. |  | parameters. |
| Note: Many browsers fail to parse challenges containing unknown |  | Note: Many browsers fail to parse challenges containing unknown |
| schemes. A workaround for this problem is to list well-supported |  | schemes. A workaround for this problem is to list well-supported |
| schemes (such as "basic") first. |  | schemes (such as "basic") first. |
| The authentication parameter realm is defined for all authentication |  |  |
| schemes: |  |  |
| realm = "realm" "=" realm-value |  |  |
| realm-value = quoted-string |  |  |
| The realm directive (case-insensitive) is required for all |  |  |
| authentication schemes that issue a challenge. The realm value |  |  |
| (case-sensitive), in combination with the canonical root URI (the |  |  |
| scheme and authority components of the effective request URI; see |  |  |
| Section 4.3 of [Part1]) of the server being accessed, defines the |  |  |
| protection space. These realms allow the protected resources on a |  |  |
| server to be partitioned into a set of protection spaces, each with |  |  |
| its own authentication scheme and/or authorization database. The |  |  |
| realm value is a string, generally assigned by the origin server, |  |  |
| which can have additional semantics specific to the authentication |  |  |
| scheme. Note that there can be multiple challenges with the same |  |  |
| auth-scheme but different realms. |  |  |
| A user agent that wishes to authenticate itself with an origin server |  | A user agent that wishes to authenticate itself with an origin server |
| -- usually, but not necessarily, after receiving a 401 (Unauthorized) |  | -- usually, but not necessarily, after receiving a 401 (Unauthorized) |
| -- MAY do so by including an Authorization header field with the |  | -- MAY do so by including an Authorization header field with the |
| request. A client that wishes to authenticate itself with a proxy -- |  | request. |
| usually, but not necessarily, after receiving a 407 (Proxy |  |  |
| Authentication Required) -- MAY do so by including a Proxy- |  |  |
| Authorization header field with the request. Both the Authorization |  |  |
| field value and the Proxy-Authorization field value consist of |  |  |
| credentials containing the authentication information of the client |  |  |
| for the realm of the resource being requested. The user agent MUST |  |  |
| choose to use one of the challenges with the strongest auth-scheme it |  |  |
| understands and request credentials from the user based upon that |  |  |
| challenge. |  |  |
| credentials = auth-scheme ( token |  | A client that wishes to authenticate itself with a proxy -- usually, |
| / quoted-string |  | but not necessarily, after receiving a 407 (Proxy Authentication |
| / #auth-param ) |  | Required) -- MAY do so by including a Proxy-Authorization header |
|  |  | field with the request. |
| The protection space determines the domain over which credentials can |  | Both the Authorization field value and the Proxy-Authorization field |
| be automatically applied. If a prior request has been authorized, |  | value consist of credentials containing the authentication |
| the same credentials MAY be reused for all other requests within that |  | information of the client for the realm of the resource being |
| protection space for a period of time determined by the |  | requested. The user agent MUST choose to use one of the challenges |
| authentication scheme, parameters, and/or user preference. Unless |  | with the strongest auth-scheme it understands and request credentials |
| otherwise defined by the authentication scheme, a single protection |  | from the user based upon that challenge. |
| space cannot extend outside the scope of its server. |  |  |
|  |  | credentials = auth-scheme [ 1*SP ( b64token / #auth-param ) ] |
| If the origin server does not wish to accept the credentials sent |  | If the origin server does not wish to accept the credentials sent |
| with a request, it SHOULD return a 401 (Unauthorized) response. The |  | with a request, it SHOULD return a 401 (Unauthorized) response. The |
| response MUST include a WWW-Authenticate header field containing at |  | response MUST include a WWW-Authenticate header field containing at |
| least one (possibly new) challenge applicable to the requested |  | least one (possibly new) challenge applicable to the requested |
| resource. If a proxy does not accept the credentials sent with a |  |  |
| request, it SHOULD return a 407 (Proxy Authentication Required). The |  |  |
| response MUST include a Proxy-Authenticate header field containing a |  |  |
| (possibly new) challenge applicable to the proxy for the requested |  |  |
| resource. |  | resource. |
|  |  | If a proxy does not accept the credentials sent with a request, it |
|  |  | SHOULD return a 407 (Proxy Authentication Required). The response |
|  |  | MUST include a Proxy-Authenticate header field containing a (possibly |
|  |  | new) challenge applicable to the proxy for the requested resource. |
| The HTTP protocol does not restrict applications to this simple |  | The HTTP protocol does not restrict applications to this simple |
| challenge-response mechanism for access authentication. Additional |  | challenge-response mechanism for access authentication. Additional |
| mechanisms MAY be used, such as encryption at the transport level or |  | mechanisms MAY be used, such as encryption at the transport level or |
| via message encapsulation, and with additional header fields |  | via message encapsulation, and with additional header fields |
| specifying authentication information. However, such additional |  | specifying authentication information. However, such additional |
| mechanisms are not defined by this specification. |  | mechanisms are not defined by this specification. |
| Proxies MUST forward the WWW-Authenticate and Authorization headers |  | Proxies MUST forward the WWW-Authenticate and Authorization headers |
| unmodified and follow the rules found in Section 4.1. |  | unmodified and follow the rules found in Section 4.1. |
| 2.1. Authentication Scheme Registry |  | 2.2. Protection Space (Realm) |
|  |  | The authentication parameter realm is reserved for use by |
|  |  | authentication schemes that wish to indicate the scope of protection: |
|  |  | realm = "realm" BWS "=" BWS realm-value |
|  |  | realm-value = quoted-string |
|  |  | A protection space is defined by the canonical root URI (the scheme |
|  |  | and authority components of the effective request URI; see Section |
|  |  | 4.3 of [Part1]) of the server being accessed, in combination with the |
|  |  | realm value if present. These realms allow the protected resources |
|  |  | on a server to be partitioned into a set of protection spaces, each |
|  |  | with its own authentication scheme and/or authorization database. |
|  |  | The realm value is a string, generally assigned by the origin server, |
|  |  | which can have additional semantics specific to the authentication |
|  |  | scheme. Note that there can be multiple challenges with the same |
|  |  | auth-scheme but different realms. |
|  |  | The protection space determines the domain over which credentials can |
|  |  | be automatically applied. If a prior request has been authorized, |
|  |  | the same credentials MAY be reused for all other requests within that |
|  |  | protection space for a period of time determined by the |
|  |  | authentication scheme, parameters, and/or user preference. Unless |
|  |  | otherwise defined by the authentication scheme, a single protection |
|  |  | space cannot extend outside the scope of its server. |
|  |  | 2.3. Authentication Scheme Registry |
| The HTTP Authentication Scheme Registry defines the name space for |  | The HTTP Authentication Scheme Registry defines the name space for |
| the authentication schemes in challenges and credentials. |  | the authentication schemes in challenges and credentials. |
| Registrations MUST include the following fields: |  | Registrations MUST include the following fields: |
| o Authentication Scheme Name |  | o Authentication Scheme Name |
| o Pointer to specification text |  | o Pointer to specification text |
|  |  | o Notes (optional) |
| Values to be added to this name space are subject to IETF review |  | Values to be added to this name space are subject to IETF review |
| ([RFC5226], Section 4.1). |  | ([RFC5226], Section 4.1). |
| The registry itself is maintained at |  | The registry itself is maintained at |
| <http://www.iana.org/assignments/http-authschemes>. |  | <http://www.iana.org/assignments/http-authschemes>. |
|  |  | 2.3.1. Considerations for New Authentication Schemes |
|  |  | There are certain aspects of the HTTP Authentication Framework that |
|  |  | put constraints on how new authentication schemes can work: |
|  |  | o Authentication schemes need to be compatible with the inherent |
|  |  | constraints of HTTP; for instance, that messages need to keep |
|  |  | their semantics when inspected in isolation, thus an |
|  |  | authentication scheme can not bind information to the TCP session |
|  |  | over which the message was received (see Section 2.2 of [Part1]). |
|  |  | o The authentication parameter "realm" is reserved for defining |
|  |  | Protection Spaces as defined in Section 2.2. New schemes MUST NOT |
|  |  | use it in a way incompatible with that definition. |
|  |  | o The "b64token" notation was introduced for compatibility with |
|  |  | existing authentication schemes and can only be used once per |
|  |  | challenge/credentials. New schemes thus ought to use the "auth- |
|  |  | param" syntax instead, because otherwise future extensions will be |
|  |  | impossible. |
|  |  | o Authentication schemes need to document whether they are usable in |
|  |  | origin-server authentication (i.e., using WWW-Authenticate), |
|  |  | and/or proxy authentication (i.e., using Proxy-Authenticate). |
|  |  | o The credentials carried in an Authorization header field are |
|  |  | specific to the User Agent, and therefore have the same effect on |
|  |  | HTTP caches as the "private" Cache-Control response directive, |
|  |  | within the scope of the request they appear in. |
|  |  | Therefore, new authentication schemes which choose not to carry |
|  |  | credentials in the Authorization header (e.g., using a newly |
|  |  | defined header) will need to explicitly disallow caching, by |
|  |  | mandating the use of either Cache-Control request directives |
|  |  | (e.g., "no-store") or response directives (e.g., "private"). |
| 3. Status Code Definitions |  | 3. Status Code Definitions |
| 3.1. 401 Unauthorized |  | 3.1. 401 Unauthorized |
| The request requires user authentication. The response MUST include |  | The request requires user authentication. The response MUST include |
| a WWW-Authenticate header field (Section 4.4) containing a challenge |  | a WWW-Authenticate header field (Section 4.4) containing a challenge |
| applicable to the target resource. The client MAY repeat the request |  | applicable to the target resource. The client MAY repeat the request |
| with a suitable Authorization header field (Section 4.1). If the |  | with a suitable Authorization header field (Section 4.1). If the |
| request already included Authorization credentials, then the 401 |  | request already included Authorization credentials, then the 401 |
| response indicates that authorization has been refused for those |  | response indicates that authorization has been refused for those |
| skipping to change at page 9, line 45 |  | skipping to change at page 11, line 9 |
| chain, the Proxy-Authorization header field is consumed by the first |  | chain, the Proxy-Authorization header field is consumed by the first |
| outbound proxy that was expecting to receive credentials. A proxy |  | outbound proxy that was expecting to receive credentials. A proxy |
| MAY relay the credentials from the client request to the next proxy |  | MAY relay the credentials from the client request to the next proxy |
| if that is the mechanism by which the proxies cooperatively |  | if that is the mechanism by which the proxies cooperatively |
| authenticate a given request. |  | authenticate a given request. |
| 4.4. WWW-Authenticate |  | 4.4. WWW-Authenticate |
| The "WWW-Authenticate" header field consists of at least one |  | The "WWW-Authenticate" header field consists of at least one |
| challenge that indicates the authentication scheme(s) and parameters |  | challenge that indicates the authentication scheme(s) and parameters |
| applicable to the effective request URI (Section 4.3 of [Part1]). It |  | applicable to the effective request URI (Section 4.3 of [Part1]). |
| MUST be included in 401 (Unauthorized) response messages. |  |  |
|  |  | It MUST be included in 401 (Unauthorized) response messages and MAY |
|  |  | be included in other response messages to indicate that supplying |
|  |  | credentials (or different credentials) might affect the response. |
| WWW-Authenticate = 1#challenge |  | WWW-Authenticate = 1#challenge |
| User agents are advised to take special care in parsing the WWW- |  | User agents are advised to take special care in parsing the WWW- |
| Authenticate field value as it might contain more than one challenge, |  | Authenticate field value as it might contain more than one challenge, |
| or if more than one WWW-Authenticate header field is provided, the |  | or if more than one WWW-Authenticate header field is provided, the |
| contents of a challenge itself can contain a comma-separated list of |  | contents of a challenge itself can contain a comma-separated list of |
| authentication parameters. |  | authentication parameters. |
| 5. IANA Considerations |  | 5. IANA Considerations |
| 5.1. Authenticaton Scheme Registry |  | 5.1. Authenticaton Scheme Registry |
| The registration procedure for HTTP Authentication Schemes is defined |  | The registration procedure for HTTP Authentication Schemes is defined |
| by Section 2.1 of this document. |  | by Section 2.3 of this document. |
| The HTTP Method Authentication Scheme shall be created at |  | The HTTP Method Authentication Scheme shall be created at |
| <http://www.iana.org/assignments/http-authschemes>. |  | <http://www.iana.org/assignments/http-authschemes>. |
| 5.2. Status Code Registration |  | 5.2. Status Code Registration |
| The HTTP Status Code Registry located at |  | The HTTP Status Code Registry located at |
| <http://www.iana.org/assignments/http-status-codes> shall be updated |  | <http://www.iana.org/assignments/http-status-codes> shall be updated |
| with the registrations below: |  | with the registrations below: |
| skipping to change at page 11, line 38 |  | skipping to change at page 13, line 9 |
| password protection in screen savers, idle time-outs, and other |  | password protection in screen savers, idle time-outs, and other |
| methods which mitigate the security problems inherent in this |  | methods which mitigate the security problems inherent in this |
| problem. In particular, user agents which cache credentials are |  | problem. In particular, user agents which cache credentials are |
| encouraged to provide a readily accessible mechanism for discarding |  | encouraged to provide a readily accessible mechanism for discarding |
| cached credentials under user control. |  | cached credentials under user control. |
| 7. Acknowledgments |  | 7. Acknowledgments |
| This specification takes over the definition of the HTTP |  | This specification takes over the definition of the HTTP |
| Authentication Framework, previously defined in RFC 2617. We thank |  | Authentication Framework, previously defined in RFC 2617. We thank |
| to John Franks, Phillip M. Hallam-Baker, Jeffery L. Hostetler, Scott |  | John Franks, Phillip M. Hallam-Baker, Jeffery L. Hostetler, Scott D. |
| D. Lawrence, Paul J. Leach, Ari Luotonen, and Lawrence C. Stewart for |  | Lawrence, Paul J. Leach, Ari Luotonen, and Lawrence C. Stewart for |
| their work on that specification. |  | their work on that specification. See Section 6 of [RFC2617] for |
|  |  | further acknowledgements. |
| [[acks: HTTPbis acknowledgements.]] |  | See Section 12 of [Part1] for the Acknowledgments related to this |
|  |  | document revision. |
| 8. References |  | 8. References |
| 8.1. Normative References |  | 8.1. Normative References |
| [Part1] Fielding, R., Ed., Gettys, J., Mogul, J., Frystyk, H., |  | [Part1] Fielding, R., Ed., Gettys, J., Mogul, J., Frystyk, H., |
| Masinter, L., Leach, P., Berners-Lee, T., Lafon, Y., Ed., |  | Masinter, L., Leach, P., Berners-Lee, T., Lafon, Y., Ed., |
| and J. Reschke, Ed., "HTTP/1.1, part 1: URIs, Connections, |  | and J. Reschke, Ed., "HTTP/1.1, part 1: URIs, Connections, |
| and Message Parsing", draft-ietf-httpbis-p1-messaging-15 |  | and Message Parsing", draft-ietf-httpbis-p1-messaging-16 |
| (work in progress), July 2011. |  | (work in progress), August 2011. |
| [Part6] Fielding, R., Ed., Gettys, J., Mogul, J., Frystyk, H., |  | [Part6] Fielding, R., Ed., Gettys, J., Mogul, J., Frystyk, H., |
| Masinter, L., Leach, P., Berners-Lee, T., Lafon, Y., Ed., |  | Masinter, L., Leach, P., Berners-Lee, T., Lafon, Y., Ed., |
| Nottingham, M., Ed., and J. Reschke, Ed., "HTTP/1.1, part |  | Nottingham, M., Ed., and J. Reschke, Ed., "HTTP/1.1, part |
| 6: Caching", draft-ietf-httpbis-p6-cache-15 (work in |  | 6: Caching", draft-ietf-httpbis-p6-cache-16 (work in |
| progress), July 2011. |  | progress), August 2011. |
| [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate |  | [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate |
| Requirement Levels", BCP 14, RFC 2119, March 1997. |  | Requirement Levels", BCP 14, RFC 2119, March 1997. |
| [RFC5234] Crocker, D., Ed. and P. Overell, "Augmented BNF for Syntax |  | [RFC5234] Crocker, D., Ed. and P. Overell, "Augmented BNF for Syntax |
| Specifications: ABNF", STD 68, RFC 5234, January 2008. |  | Specifications: ABNF", STD 68, RFC 5234, January 2008. |
| 8.2. Informative References |  | 8.2. Informative References |
| [RFC2616] Fielding, R., Gettys, J., Mogul, J., Frystyk, H., |  | [RFC2616] Fielding, R., Gettys, J., Mogul, J., Frystyk, H., |
| skipping to change at page 12, line 33 |  | skipping to change at page 14, line 5 |
| [RFC2617] Franks, J., Hallam-Baker, P., Hostetler, J., Lawrence, S., |  | [RFC2617] Franks, J., Hallam-Baker, P., Hostetler, J., Lawrence, S., |
| Leach, P., Luotonen, A., and L. Stewart, "HTTP |  | Leach, P., Luotonen, A., and L. Stewart, "HTTP |
| Authentication: Basic and Digest Access Authentication", |  | Authentication: Basic and Digest Access Authentication", |
| RFC 2617, June 1999. |  | RFC 2617, June 1999. |
| [RFC3864] Klyne, G., Nottingham, M., and J. Mogul, "Registration |  | [RFC3864] Klyne, G., Nottingham, M., and J. Mogul, "Registration |
| Procedures for Message Header Fields", BCP 90, RFC 3864, |  | Procedures for Message Header Fields", BCP 90, RFC 3864, |
| September 2004. |  | September 2004. |
|  |  | [RFC3986] Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform |
|  |  | Resource Identifier (URI): Generic Syntax", STD 66, |
|  |  | RFC 3986, January 2005. |
|  |  | [RFC4648] Josefsson, S., "The Base16, Base32, and Base64 Data |
|  |  | Encodings", RFC 4648, October 2006. |
| [RFC5226] Narten, T. and H. Alvestrand, "Guidelines for Writing an |  | [RFC5226] Narten, T. and H. Alvestrand, "Guidelines for Writing an |
| IANA Considerations Section in RFCs", BCP 26, RFC 5226, |  | IANA Considerations Section in RFCs", BCP 26, RFC 5226, |
| May 2008. |  | May 2008. |
| Appendix A. Changes from RFC 2616 |  | Appendix A. Changes from RFCs 2616 and 2617 |
|  |  | The "realm" parameter isn't required anymore in general; |
|  |  | consequently, the ABNF allows challenges without any auth parameters. |
|  |  | (Section 2) |
|  |  | The "b64token" alternative to auth-param lists has been added for |
|  |  | consistency with legacy authentication schemes such as "Basic". |
|  |  | (Section 2) |
| Change ABNF productions for header fields to only define the field |  | Change ABNF productions for header fields to only define the field |
| value. (Section 4) |  | value. (Section 4) |
| Appendix B. Collected ABNF |  | Appendix B. Collected ABNF |
| Authorization = credentials |  | Authorization = credentials |
|  |  | BWS = <BWS, defined in [Part1], Section 1.2.2> |
| OWS = <OWS, defined in [Part1], Section 1.2.2> |  | OWS = <OWS, defined in [Part1], Section 1.2.2> |
| Proxy-Authenticate = *( "," OWS ) challenge *( OWS "," [ OWS |  | Proxy-Authenticate = *( "," OWS ) challenge *( OWS "," [ OWS |
| challenge ] ) |  | challenge ] ) |
| Proxy-Authorization = credentials |  | Proxy-Authorization = credentials |
| WWW-Authenticate = *( "," OWS ) challenge *( OWS "," [ OWS challenge |  | WWW-Authenticate = *( "," OWS ) challenge *( OWS "," [ OWS challenge |
| ] ) |  | ] ) |
| auth-param = token "=" ( token / quoted-string ) |  | auth-param = token BWS "=" BWS ( token / quoted-string ) |
| auth-scheme = token |  | auth-scheme = token |
| challenge = auth-scheme 1*SP *( "," OWS ) auth-param *( OWS "," [ OWS |  | b64token = 1*( ALPHA / DIGIT / "-" / "." / "_" / "~" / "+" / "/" ) |
| auth-param ] ) |  | *"=" |
| credentials = auth-scheme ( token / quoted-string / [ ( "," / |  |  |
| auth-param ) *( OWS "," [ OWS auth-param ] ) ] ) |  |  |
| quoted-string = <quoted-string, defined in [Part1], Section 1.2.2> |  | challenge = auth-scheme [ 1*SP ( b64token / [ ( "," / auth-param ) *( |
|  |  | OWS "," [ OWS auth-param ] ) ] ) ] |
|  |  | credentials = auth-scheme [ 1*SP ( b64token / [ ( "," / auth-param ) |
|  |  | *( OWS "," [ OWS auth-param ] ) ] ) ] |
| realm = "realm=" realm-value |  | quoted-string = <quoted-string, defined in [Part1], Section 3.2.3> |
|  |  | realm = "realm" BWS "=" BWS realm-value |
| realm-value = quoted-string |  | realm-value = quoted-string |
| token = <token, defined in [Part1], Section 1.2.2> |  | token = <token, defined in [Part1], Section 3.2.3> |
| ABNF diagnostics: |  | ABNF diagnostics: |
| ; Authorization defined but not used |  | ; Authorization defined but not used |
| ; Proxy-Authenticate defined but not used |  | ; Proxy-Authenticate defined but not used |
| ; Proxy-Authorization defined but not used |  | ; Proxy-Authorization defined but not used |
| ; WWW-Authenticate defined but not used |  | ; WWW-Authenticate defined but not used |
| ; realm defined but not used |  | ; realm defined but not used |
| Appendix C. Change Log (to be removed by RFC Editor before publication) |  | Appendix C. Change Log (to be removed by RFC Editor before publication) |
| skipping to change at page 14, line 26 |  | skipping to change at page 16, line 33 |
| C.4. Since draft-ietf-httpbis-p7-auth-02 |  | C.4. Since draft-ietf-httpbis-p7-auth-02 |
| Ongoing work on IANA Message Header Field Registration |  | Ongoing work on IANA Message Header Field Registration |
| (<http://tools.ietf.org/wg/httpbis/trac/ticket/40>): |  | (<http://tools.ietf.org/wg/httpbis/trac/ticket/40>): |
| o Reference RFC 3984, and update header field registrations for |  | o Reference RFC 3984, and update header field registrations for |
| header fields defined in this document. |  | header fields defined in this document. |
| C.5. Since draft-ietf-httpbis-p7-auth-03 |  | C.5. Since draft-ietf-httpbis-p7-auth-03 |
|  |  | None. |
| C.6. Since draft-ietf-httpbis-p7-auth-04 |  | C.6. Since draft-ietf-httpbis-p7-auth-04 |
| Ongoing work on ABNF conversion |  | Ongoing work on ABNF conversion |
| (<http://tools.ietf.org/wg/httpbis/trac/ticket/36>): |  | (<http://tools.ietf.org/wg/httpbis/trac/ticket/36>): |
| o Use "/" instead of "|" for alternatives. |  | o Use "/" instead of "|" for alternatives. |
| o Introduce new ABNF rules for "bad" whitespace ("BWS"), optional |  | o Introduce new ABNF rules for "bad" whitespace ("BWS"), optional |
| whitespace ("OWS") and required whitespace ("RWS"). |  | whitespace ("OWS") and required whitespace ("RWS"). |
| skipping to change at page 16, line 16 |  | skipping to change at page 18, line 23 |
| Closed issues: |  | Closed issues: |
| o <http://tools.ietf.org/wg/httpbis/trac/ticket/276>: "untangle |  | o <http://tools.ietf.org/wg/httpbis/trac/ticket/276>: "untangle |
| ABNFs for header fields" |  | ABNFs for header fields" |
| C.16. Since draft-ietf-httpbis-p7-auth-14 |  | C.16. Since draft-ietf-httpbis-p7-auth-14 |
| None. |  | None. |
|  |  | C.17. Since draft-ietf-httpbis-p7-auth-15 |
|  |  | Closed issues: |
|  |  | o <http://tools.ietf.org/wg/httpbis/trac/ticket/78>: "Relationship |
|  |  | between 401, Authorization and WWW-Authenticate" |
|  |  | o <http://tools.ietf.org/wg/httpbis/trac/ticket/177>: "Realm |
|  |  | required on challenges" |
|  |  | o <http://tools.ietf.org/wg/httpbis/trac/ticket/195>: "auth-param |
|  |  | syntax" |
|  |  | o <http://tools.ietf.org/wg/httpbis/trac/ticket/257>: |
|  |  | "Considerations for new authentications schemes" |
|  |  | o <http://tools.ietf.org/wg/httpbis/trac/ticket/287>: "LWS in auth- |
|  |  | param ABNF" |
|  |  | o <http://tools.ietf.org/wg/httpbis/trac/ticket/309>: "credentials |
|  |  | ABNF missing SP (still using implied LWS?)" |
| Index |  | Index |
| 4 |  | 4 |
| 401 Unauthorized (status code) 7 |  | 401 Unauthorized (status code) 8 |
| 407 Proxy Authentication Required (status code) 7 |  | 407 Proxy Authentication Required (status code) 9 |
| A |  | A |
| auth-param 5 |  | auth-param 5 |
| auth-scheme 5 |  | auth-scheme 5 |
| Authorization header field 8 |  | Authorization header field 9 |
|  |  | B |
|  |  | b64token 5 |
| C |  | C |
| challenge 5 |  | challenge 5 |
| credentials 6 |  | credentials 6 |
| G |  | G |
| Grammar |  | Grammar |
| Authorization 8 |  | auth-param 5 |
| Proxy-Authenticate 9 |  | auth-scheme 5 |
| Proxy-Authorization 9 |  | Authorization 9 |
| WWW-Authenticate 9 |  | b64token 5 |
|  |  | challenge 5 |
|  |  | credentials 6 |
|  |  | Proxy-Authenticate 10 |
|  |  | Proxy-Authorization 10 |
|  |  | realm 7 |
|  |  | WWW-Authenticate 11 |
| H |  | H |
| Header Fields |  | Header Fields |
| Authorization 8 |  | Authorization 9 |
| Proxy-Authenticate 9 |  | Proxy-Authenticate 10 |
| Proxy-Authorization 9 |  | Proxy-Authorization 10 |
| WWW-Authenticate 9 |  | WWW-Authenticate 11 |
| P |  | P |
| Proxy-Authenticate header field 9 |  | Protection Space 7 |
| Proxy-Authorization header field 9 |  | Proxy-Authenticate header field 10 |
|  |  | Proxy-Authorization header field 10 |
| R |  | R |
| realm 5 |  | Realm 7 |
| realm-value 5 |  | realm 7 |
|  |  | realm-value 7 |
| S |  | S |
| Status Codes |  | Status Codes |
| 401 Unauthorized 7 |  | 401 Unauthorized 8 |
| 407 Proxy Authentication Required 7 |  | 407 Proxy Authentication Required 9 |
| W |  | W |
| WWW-Authenticate header field 9 |  | WWW-Authenticate header field 11 |
| Authors' Addresses |  | Authors' Addresses |
| Roy T. Fielding (editor) |  | Roy T. Fielding (editor) |
| Adobe Systems Incorporated |  | Adobe Systems Incorporated |
| 345 Park Ave |  | 345 Park Ave |
| San Jose, CA 95110 |  | San Jose, CA 95110 |
| USA |  | USA |
| EMail: fielding@gbiv.com |  | EMail: fielding@gbiv.com |
End of changes. 51 change blocks.
| 145 lines changed or deleted |  | 266 lines changed or added |
This html diff was produced by rfcdiff 1.38. The latest version is available from http://tools.ietf.org/tools/rfcdiff/