Simple Authentication and Security Layer (SASL) is a
framework for
authentication
Authentication (from ''authentikos'', "real, genuine", from αὐθέντης ''authentes'', "author") is the act of proving an Logical assertion, assertion, such as the Digital identity, identity of a computer system user. In contrast with iden ...
and
data security
Data security or data protection means protecting digital data, such as those in a database, from destructive forces and from the unwanted actions of unauthorized users, such as a cyberattack or a data breach.
Technologies
Disk encryption
...
in Internet
protocols. It decouples authentication mechanisms from
application protocols, in theory allowing any authentication mechanism supported by SASL to be used in any application protocol that uses SASL. Authentication mechanisms can also support ''proxy authorization'', a facility allowing one user to assume the identity of another. They can also provide a ''data security layer'' offering ''data integrity'' and ''data confidentiality'' services. DIGEST-MD5 provides an example of mechanisms which can provide a data-security layer. Application protocols that support SASL typically also support
Transport Layer Security
Transport Layer Security (TLS) is a cryptographic protocol designed to provide communications security over a computer network, such as the Internet. The protocol is widely used in applications such as email, instant messaging, and voice over ...
(TLS) to complement the services offered by SASL.
John Gardiner Myers wrote the original SASL specification (RFC 2222) in 1997. In 2006, that document was replaced by RFC 4422 authored by Alexey Melnikov and Kurt D. Zeilenga. SASL, as defined by RFC 4422 is an
IETF
The Internet Engineering Task Force (IETF) is a standards organization for the Internet standard, Internet and is responsible for the technical standards that make up the Internet protocol suite (TCP/IP). It has no formal membership roster ...
''Standard Track'' protocol and is, , a ''
Proposed Standard''.
SASL mechanisms
A SASL mechanism implements a series of challenges and responses. Defined SASL mechanisms include:
SASL-aware application protocols
Application protocols define their representation of SASL exchanges with a ''profile''. A protocol has a ''service name'' such as "ldap" in a registry shared with
GSSAPI and
Kerberos.
protocols currently supporting SASL include:
*
Application Configuration Access Protocol
*
Advanced Message Queuing Protocol
The Advanced Message Queuing Protocol (AMQP) is an open standard application layer protocol for message-oriented middleware. The defining features of AMQP are message orientation, queuing, routing (including point-to-point and publish-and-subs ...
(AMQP)
*
Blocks Extensible Exchange Protocol
*
Internet Message Access Protocol (IMAP)
*
Internet Message Support Protocol
*
Internet Relay Chat
IRC (Internet Relay Chat) is a text-based chat system for instant messaging. IRC is designed for Many-to-many, group communication in discussion forums, called ''#Channels, channels'', but also allows one-on-one communication via instant mess ...
(IRC) (with
IRCX or th
IRCv3 SASL extension
*
Lightweight Directory Access Protocol
The Lightweight Directory Access Protocol (LDAP ) is an open, vendor-neutral, industry standard application protocol for accessing and maintaining distributed directory information services over an Internet Protocol (IP) network. Directory serv ...
(LDAP)
*
libvirt
* ManageSieve (RFC 5804)
*
memcached
Memcached (pronounced variously /mɛmkæʃˈdiː/ ''mem-cash-dee'' or /ˈmɛmkæʃt/ ''mem-cashed'') is a general-purpose distributed memory-caching system. It is often used to speed up dynamic database-driven websites by caching data and object ...
*
Post Office Protocol
In computing, the Post Office Protocol (POP) is an application-layer Internet standard protocol used by e-mail clients to retrieve e-mail from a mail server. Today, POP version 3 (POP3) is the most commonly used version. Together with IMAP, ...
(POP)
*
Remote framebuffer protocol used by
VNC
*
Simple Mail Transfer Protocol (SMTP)
*
Subversion
Subversion () refers to a process by which the values and principles of a system in place are contradicted or reversed in an attempt to sabotage the established social order and its structures of Power (philosophy), power, authority, tradition, h ...
protocol
*
Extensible Messaging and Presence Protocol
Extensible Messaging and Presence Protocol (abbreviation XMPP, originally named Jabber) is an open communication protocol designed for instant messaging (IM), presence information, and contact list maintenance. Based on XML (Extensible Marku ...
(XMPP)
See also
*
Transport Layer Security
Transport Layer Security (TLS) is a cryptographic protocol designed to provide communications security over a computer network, such as the Internet. The protocol is widely used in applications such as email, instant messaging, and voice over ...
(TLS)
References
External links
* - Simple Authentication and Security Layer (SASL) - obsoletes
* - Anonymous Simple Authentication and Security Layer (SASL) Mechanism - obsoletes
* - The PLAIN Simple Authentication and Security Layer (SASL) Mechanism - updates
* The IET
SASL Working Group chartered to revise existing SASL specifications, as well as to develop a family of GSSAPI mechanisms
Cyrus SASL a free and portable SASL library providing generic security for various applications
GNU SASL a free and portable SASL command-line utility and library, distributed under the
GNU GPLv3
The GNU General Public Licenses (GNU GPL or simply GPL) are a series of widely used free software licenses, or ''copyleft'' licenses, that guarantee end users the freedom to run, study, share, or modify the software. The GPL was the first ...
and
LGPLv2.1, respectively
Dovecot SASL an SASL implementation
* ''(historic)'' - Using Digest Authentication as a SASL Mechanism, obsoleted in
Programming and Deployment Guide
{{Authentication APIs
Cryptographic protocols
Internet Standards
Computer access control protocols