Subject: [Wocky] [Fwd: [Gaim-devel] Jabber, SASL, passwords, binary packages]

From: Greg Hudson <[email-masked]>
Date: Wed, 21 Dec 2005 10:32:16 -0500

I realized this morning that I cannot easily adapt my password-request
support to Simon's Cyrus SASL patch, because Cyrus SASL will be
requesting the password in a callback which must return the information
immediately.  Since we can't put up modal dialogs in Gaim given it's
architecture, we need another approach.

Also, I'm afraid that binary packagers on some platforms (particularly
Windows) won't build in Cyrus SASL support.  So I sent this message to
gaim-devel proposing a gaim_sasl layer which (a) can have a direct
dynamically-loaded GSSAPI implementation when the Cyrus SASL plugin
isn't available, and (b) will "just know" when a given mechanism is
going to require a password.  Here's the message I sent.

Subject: [Gaim-devel] Jabber, SASL, passwords, binary packages
From: Greg Hudson <[email-masked]>
To: [email-masked]
Cc: [email-masked]
Date: Wed, 21 Dec 2005 10:25:53 -0500
List-Id: <gaim-devel.lists.sourceforge.net>

I see that Gaim has integrated Simon's Cyrus SASL patch.  From a
Kerberos-using site: thank you!  Single sign-on support is very
important to us, and we'd very much like to get to the point where
stock Gaim builds can support GSSAPI authentication to Jabber servers.

That said, there are a couple of technical issues.  I realize obscure
authentication support in the Jabber plugin is probably not a big
developer focus, but please bear with me:

  * Binary packagers might not be comfortable building in Cyrus SASL
    support, because it would make the Gaim core (or at least the
    Jabber prpl) dependent on a big dependency tree of non-ubiquitous
    libraries.

  * Passwords.  Simon's patch just marked Jabber as having optional
    passwords, which broke password authentication when the account is
    not remembering the password.  That part of his change was
    reverted a couple days after the integration, but now Jabber
    connections are going to ask for a password even though a
    passwordless mechanism like GSSAPI might be used.

    The obvious solution would be to wait until the Cyrus SASL library
    asks us for a password, and then if we don't have one yet, put up
    a dialog asking for it.  That's how the SASL_CB_PASS callback is
    supposed to work, right?  Well, it's not that easy.  Because of
    Gaim's architecture, we can't be putting up modal dialogs asking
    for information, and the Cyrus SASL callback can't be told "go
    take a breather; I'll have that password for you at some
    unspecified time in the future."

Here is my proposal:

  * We introduce a gaim_sasl module much like the gaim_ssl module in
    the core sources.

  * We introduce a plugin to wrap the Cyrus SASL library, just as we
    have SSL plugins to wrap gnutls and nspr.

  * The gaim_sasl module uses the Cyrus SASL plugin when available, or
    the existing built-in PLAIN/DIGEST-MD5 code otherwise.  (And maybe
    a direct implementation of GSSAPI as well; Simon also has code to
    try to dynamically load a GSSAPI library and use it, which would
    mean GSSAPI support can be built in unconditionally and used when
    the target system has a GSSAPI library available.  Makes it very
    easy to support GSSAPI on Windows in particular.)

  * The gaim_sasl module contains knowledge of which mechanisms need
    passwords, so that the Jabber plugin can request a password if
    necessary after it reads the server's mechanism list but before it
    has called into the Cyrus SASL library to do negotiation.

Does that sound reasonable?  This will be a fair amount of work, so
I'd like a design review ahead of time.

-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
_______________________________________________
Gaim-devel mailing list
[email-masked]
https://lists.sourceforge.net/lists/listinfo/gaim-devel