Subject: Re: [SIP] The Null authentication scheme

From: [email-masked]
Date: Mon, 25 Sep 2000 19:00:10 +0530

Hi, this seems to be useful if its the server who prompts the question of
"I support Null, if you care".
However, if I take the approach of the client saying "Here is an
unauthenticated request, process as you may" to
the server:

A client passes its authentication info to the server if it wants to. If it
does not, and the server supports 'no authentication'
scheme, it anyway proceeds to treat this request as an unknown.

So then , if we say its really a clients wish if it wants to authenticate
itself, and the servers descision thereof to accept him
or reject him with a final response, do we really need this scheme ?

Regds
Arjun

--
Arjun Roychowdhury @ Hughes Software Systems

Henning Schulzrinne <[email-masked]> on 09/24/2000 07:16:50 PM

To:   [email-masked]
cc:

Subject:  [SIP] The Null authentication scheme

Following some internal discussions, I wrote up a very short I-D on the
Null authentication scheme. Motivation is in the draft:

http://www.cs.columbia.edu/~hgs/sip/drafts/draft-schulzrinne-sip-null-00.tx
t

Before I submit this as an I-D, I'd like to know if this is a completely
brain-dead idea.
--
Henning Schulzrinne   http://www.cs.columbia.edu/~hgs

_______________________________________________
SIP mailing list
[email-masked]
http://lists.bell-labs.com/mailman/listinfo/sip

_______________________________________________
SIP mailing list
[email-masked]
http://lists.bell-labs.com/mailman/listinfo/sip

---

From: "Jo Hornsby" <[email-masked]>
Date: Mon, 25 Sep 2000 14:45:28 +0100

> Hi, this seems to be useful if its the server who prompts the
> question of "I support Null, if you care".  However, if I take the
> approach of the client saying "Here is an unauthenticated request,
> process as you may" to the server:
>
> A client passes its authentication info to the server if it wants
> to. If it does not, and the server supports 'no authentication'

Hmmm... I'm not sure that this is necessarily true.

Imagine the following scenario:
I make a SIP call from my UA, which is challenged.  The Realm of
the challenge is unrecognised by my UA, so it gives me some sort
of way to enter my credentials.  I have no credentials for this
Realm, but I would like to try the call anyway.  With the normal
"OK"/"Cancel" (use-this-username-password/hang-up-call) approach,
what can I possibly do?  Having a `Null' scheme allows the UA
to add an extra button: "Please take my call even though you don't
know me".

Cheers,

 - Jo.

---

From: "Brett Tate" <[email-masked]>
Date: Mon, 25 Sep 2000 10:17:16 -0400

----- Original Message -----
From: <[email-masked]>
To: Henning Schulzrinne <[email-masked]>
Cc: <[email-masked]>
Sent: Monday, September 25, 2000 9:30 AM
Subject: Re: [SIP] The Null authentication scheme

> or reject him with a final response, do we really need this scheme ?

The draft basically provides an early way to
know that authentication will fail.  I like the
mechanism since it avoids the second INVITE
when authentication is not possible.  I assume
that some phones would not respond to 401/407
when it couldn't authenticate; thus they wouldn't
truly allow for a service that prefers authenticated
but allows unauthenticated calls.

I like the intent of the draft.  However instead of
the mechanism proposed by the draft, I'd rather
see the use of the Supported header or
something else that identifies the types of
Authentication that is expected to currently pass
by the originator.

---

From: Michael Thomas <[email-masked]>
Date: Mon, 25 Sep 2000 11:59:00 -0700 (PDT)

I guess I don't understand why the desire for a "guest account"
in SIP is in more need of standardization than the same for
HTTP. This seems much more like a BCP to me...

		 Mike