Clarify the point at which a SASL-enabled Connection may proceed

2 files changed, 26 insertions, 3 deletions

diff --git a/spec/Channel_Interface_SASL_Authentication.xml b/spec/Channel_Interface_SASL_Authentication.xml
index 6339dc2b..bb25a6b9 100644
--- a/spec/Channel_Interface_SASL_Authentication.xml
+++ b/spec/Channel_Interface_SASL_Authentication.xml
@@ -492,7 +492,11 @@ Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.</
 
         <p>In mechanisms where the server authenticates itself to the client,
           calling this method indicates that the client considers this to have
-          been successful.</p>
+          been successful. In the case of <tp:dbus-ref
+            namespace="ofdT.Channel.Type">ServerAuthentication.DRAFT2</tp:dbus-ref>
+          channels, this means that the connection manager MAY continue to
+          connect, and MAY advance the <tp:dbus-ref
+            namespace="ofdT">Connection.Status</tp:dbus-ref> to Connected.</p>
       </tp:docstring>
 
       <tp:possible-errors>
@@ -625,8 +629,9 @@ Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.</
       <tp:enumvalue suffix="Succeeded" value="4">
         <tp:docstring>
           Everyone is happy (the server sent success, and the client has called
-          <tp:member-ref>AcceptSASL</tp:member-ref>). The Handler MUST call
-          <tp:dbus-ref
+          <tp:member-ref>AcceptSASL</tp:member-ref>). Connection to the server
+          will proceed as soon as this state is reached. The Handler SHOULD
+          call <tp:dbus-ref
             namespace="org.freedesktop.Telepathy.Channel">Close</tp:dbus-ref>
           to close the channel.
         </tp:docstring>
diff --git a/spec/Channel_Type_Server_Authentication.xml b/spec/Channel_Type_Server_Authentication.xml
index c39933f4..ae5fd061 100644
--- a/spec/Channel_Type_Server_Authentication.xml
+++ b/spec/Channel_Type_Server_Authentication.xml
@@ -52,6 +52,24 @@ Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.</
           namespace="org.freedesktop.Telepathy.Channel">TargetHandle</tp:dbus-ref>
         = 0.</p>
 
+      <p>The Connection MUST NOT proceed with connection, or signal
+        <tp:dbus-ref namespace="ofdT.Connection">StatusChanged</tp:dbus-ref>
+        to the CONNECTED state, until each channel of this type has either
+        been accepted as having a positive result (for instance, on SASL
+        channels this is done with the <tp:dbus-ref
+          namespace="ofdT.Channel.Interface.SASLAuthentication.DRAFT2"
+          >AcceptSASL</tp:dbus-ref> method), or closed with the <tp:dbus-ref
+          namespace="ofdT.Channel">Close</tp:dbus-ref> method.</p>
+
+      <tp:rationale>
+        <p>ServerAuthentication channels normally represent the client
+          authenticating itself to the server, but can also be used for the
+          server to authenticate itself to the client (i.e. prove that it is
+          in fact the desired server and not an imposter). Until the
+          authentication handler has confirmed this, connection should not
+          continue.</p>
+      </tp:rationale>
+
       <p>If a channel of this type is closed with the <tp:dbus-ref
             namespace="ofdT.Channel">Close</tp:dbus-ref> method before
         authentication has succeeded, this indicates that the Handler has