Simple Authentication and Security Layer
|
|
- This article is about SASL, the authentication framework. SASL may also refer to South African Sign Language.
Simple Authentication and Security Layer (SASL) is a framework for authentication and authorization in Internet protocols. It decouples authentication mechanisms from application protocols, in theory allowing any authentication mechanism supported by SASL to be used in any application protocol that uses SASL. SASL typically only handles authentication, and another mechanism (such as TLS) is used for encrypting transferred content. However, some SASL mechanisms (such as DIGEST-MD5 and GSSAPI) do provide application data payload encryption and integrity protection.
A SASL mechanism is modelled as a series of challenges and responses. Defined SASL mechanisms [1] (http://www.iana.org/assignments/sasl-mechanisms) include:
- "EXTERNAL", where authentication is implicit in the context (e.g., for protocols already using IPsec or TLS)
- "ANONYMOUS", for unauthenticated guest access
- "PLAIN", a simple cleartext password mechanism
- "OTP" for the system that evolved from S/KEY and is defined in RFC 2289
- "CRAM-MD5" a simple challenge-response scheme based on HMAC-MD5.
- "DIGEST-MD5" an improved challenge-response scheme based on MD5, which also offer data encryption and integity.
- "NTLM"
- It is planned that GSSAPI mechanisms will be supported by a family of mechanism names.
Protocols define their representation of SASL exchanges with a profile. A protocol has a service name such as "ldap" in a registry shared with GSSAPI and Kerberos [2] (http://www.iana.org/assignments/gssapi-service-names). Protocols currently using SASL include IMAP, LDAP, POP, SMTP and XMPP.
External links
- RFC 2222 defines the SASL framework.
- The SASL Working Group (http://www.ietf.org/html.charters/sasl-charter.html) are updating the SASL specifications.
- GNU SASL (http://josefsson.org/gsasl/) is a free and portable SASL library.ca:SASL