XEP-0175: Best Practices for Use of SASL ANONYMOUS

This document specifies best practices for use of the SASL ANONYMOUS mechanism in the context of client authentication with an XMPP server.

NOTICE: This Informational specification defines a best practice or protocol profile that has been approved by the XMPP Council and/or the XSF Board of Directors. Implementations are encouraged and the best practice or protocol profile is appropriate for deployment in production systems.

Document Information

Series: XEP
Number: 0175
Publisher: XMPP Standards Foundation
Status: Active
Type: Informational
Version: 1.1
Last Updated: 2007-11-07
Approving Body: XMPP Council
Dependencies: XMPP Core
Supersedes: None
Superseded By: None
Short Name: N/A
Wiki Page: <http://wiki.jabber.org/index.php/Best Practices for Use of SASL ANONYMOUS (XEP-0175)>

Author Information

Legal Notices

Discussion Venue

The preferred venue for discussion of this document is the Standards discussion list: <http://mail.jabber.org/mailman/listinfo/standards>.

Errata may be sent to <editor@xmpp.org>.

Relation to XMPP

The Extensible Messaging and Presence Protocol (XMPP) is defined in the XMPP Core (RFC 3920) and XMPP IM (RFC 3921) specifications contributed by the XMPP Standards Foundation to the Internet Standards Process, which is managed by the Internet Engineering Task Force in accordance with RFC 2026. Any protocol defined in this document has been developed outside the Internet Standards Process and is to be understood as an extension to XMPP rather than as an evolution, development, or modification of XMPP itself.

Conformance Terms

The following keywords as used in this document are to be interpreted as described in RFC 2119: "MUST", "SHALL", "REQUIRED"; "MUST NOT", "SHALL NOT"; "SHOULD", "RECOMMENDED"; "SHOULD NOT", "NOT RECOMMENDED"; "MAY", "OPTIONAL".

Table of Contents

1. Introduction

Note: This document describes a protocol or best practice that is intended for incorporation into the specification that will supersede RFC 3920 [1] within the Internet Standards Process, i.e., rfc3920bis [2]. This document is provided only for the purpose of open community discussion of the potential modification and will be obsoleted as soon as the relevant RFC is published.

RFC 3920 allows the use of any SASL mechanism (see RFC 4422 [3]) in XMPP authentication, including the SASL ANONYMOUS mechanism (see RFC 4505 [4]). This document specifies a recommended protocol flow for such use.

Note: This document is provided for discussion purposes in order to clarify the usage of SASL ANONYMOUS in XMPP systems. It is not meant to supersede the text in RFC 3920, RFC 4422, or RFC 4505. However, the recommendations in this document may be folded into rfc3920bis.

2. Recommendation

RFC 3920 specifies that after an XMPP client authenticates with an XMPP server, it must bind a resource to the XML stream so that XML stanzas can be routed to the client. In essence there are three resource binding scenarios:

1. The client specifies a desired resource identifier and the server accepts it.
2. The client specifies a desired resource identifier but the server does not accept it, instead overruling the client and assigning a resource identifier.
3. The client asks the server to assign a resource identifier and the server does so.

No matter which scenario is enacted, at the end of the process the server informs the client of its full JID (<node@domain.tld/resource>). In particular, it might be helpful for an XMPP server to assign a full JID to the client (i.e., not just the resource identifier) if it authenticates with SASL ANONYMOUS, and to ensure that the "bare JID" portion (<node@domain.tld>) is unique in the context of the domain served by the server.

The method for ensuring the uniqueness of the node identifier is a matter of implementation. It is RECOMMENDED for the node identifier to be a UUID as specified in RFC 4122 [5].

Although RFC 4505 allows the initiating entity (client) to provide so-called "trace data" when authenticating via SASL ANONYMOUS, it is NOT RECOMMENDED to include trace data as the XML character data of the <auth/> element (instead, the <auth/> element SHOULD be empty). However, if trace data is included, the server MUST NOT use it for any purpose other than tracing (e.g., in server logs).

3. Protocol Flow

The RECOMMENDED protocol flow following TLS negotiation (refer to RFC 3920) is as follows:

1. Client initiates stream to server.

   Example 1. Stream initiation

   <stream:stream 
           xmlns:stream='http://etherx.jabber.org/streams' 
           xmlns='jabber:client' 
           to='example.com' 
           version='1.0'>
         

2. Server replies with stream header.

   Example 2. Stream header reply

   <stream:stream 
           xmlns:stream='http://etherx.jabber.org/streams' 
           xmlns='jabber:client' 
           id='c2s_234' 
           from='example.com' 
           version='1.0'>
         

3. Server advertises stream features.

   Example 3. Stream features advertisement

   <stream:features>
     <mechanisms xmlns='urn:ietf:params:xml:ns:xmpp-sasl'>
       <mechanism>DIGEST-MD5<mechanism>
       <mechanism>ANONYMOUS<mechanism>
     </mechanisms>
   </stream:features>
         

4. Client requests SASL ANONYMOUS mechanism.

   Example 4. Requesting SASL ANONYMOUS

   <auth xmlns='urn:ietf:params:xml:ns:xmpp-sasl' mechanism='ANONYMOUS'/>
         

5. Server sends <success/>.

   Example 5. Sending success

   <success xmlns='urn:ietf:params:xml:ns:xmpp-sasl'/>
         

6. Client opens new stream.

   Example 6. Initiating a new stream

   <stream:stream
           xmlns:stream='http://etherx.jabber.org/streams'
           xmlns='jabber:client'
           to='example.com'
           version='1.0'>
         

7. Server tells client that resource binding is required.

   Example 7. Stream header reply with features

   <stream:stream
           xmlns:stream='http://etherx.jabber.org/streams'
           xmlns='jabber:client'
           id='c2s_345'
           from='example.com'
           version='1.0'>
   <stream:features>
     <bind xmlns='urn:ietf:params:xml:ns:xmpp-bind'/>
   </stream:features>
         

8. Client requests that server create a resource for it.

   Example 8. Requesting resource creation

   <iq type='set' id='bind_1'>
     <bind xmlns='urn:ietf:params:xml:ns:xmpp-bind'/>
   </iq>
         

9. Server replies with full JID.

   Example 9. Server informs client of full JID

   <iq type='result' id='bind_1'>
     <bind xmlns='urn:ietf:params:xml:ns:xmpp-bind'>
       <jid>somenode@example.com/someresource</jid>
     </bind>
   </iq>
         

4. Security Considerations

This document introduces no security considerations or concerns above and beyond those discussed in RFC 3920.

5. IANA Considerations

This document requires no interaction with the Internet Assigned Numbers Authority (IANA) [6].

6. XMPP Registrar Considerations

This document requires no interaction with the XMPP Registrar [7].

Notes

Revision History

END