Subject: RE: [SIP] The Null authentication scheme

From: Jonathan Rosenberg <[email-masked]>
Date: Tue, 26 Sep 2000 02:43:12 -0400

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]
> Sent: Monday, September 25, 2000 11:40 PM
> To: Jo Hornsby
> Cc: [email-masked]; Henning Schulzrinne; [email-masked]
> Subject: RE: [SIP] The Null authentication scheme
> 
> 
> 
> 
> 
> 
> jo> Imagine the following scenario:
> jo> I make a SIP call from my UA, which is challenged.  The Realm of
> jo> the challenge is unrecognised by my UA, so it gives me some sort
> jo> of way to enter my credentials.  I have no credentials for this
> jo> Realm, but I would like to try the call anyway.  With the normal
> jo> "OK"/"Cancel" (use-this-username-password/hang-up-call) approach,
> jo> what can I possibly do?  Having a `Null' scheme allows the UA
> jo> to add an extra button: "Please take my call even though you don't
> jo> know me".
> 
> Actually what I was pointing at was that if my client had 
> made the call,
> and the
> server did support a "Null" Auth scheme, the first call 
> itself would not be
> rejected -
> the server would see that the client had not supplied auth 
> info, and so by
> default goes
> to the 'Null' handler anyway.

No; if the server has services which require stronger authentication, it
might like to check if the user can supply real credentials. When a request
arrives with no Authorization at all, it can't know whether the UA has no
credentials at the server, or just hasn't supplied them yet. Thats what the
null case helps distinguish.

-Jonathan R.
---
Jonathan D. Rosenberg                       72 Eagle Rock Ave.
Chief Scientist                             First Floor
dynamicsoft                                 East Hanover, NJ 07936
[email-masked]                     FAX:   (973) 952-5050
http://www.cs.columbia.edu/~jdrosen         PHONE: (973) 952-5000
http://www.dynamicsoft.com

_______________________________________________
SIP mailing list
[email-masked]
http://lists.bell-labs.com/mailman/listinfo/sip

---

From: "Jo Hornsby" <[email-masked]>
Date: Tue, 26 Sep 2000 09:24:56 +0100

Hi,

I've just noticed a small discrepancy.

2617 specifies the following:
	challenge   = auth-scheme 1*SP 1#auth-param
which:
	challenge   _  "Null"
would seem to disobey.  It's a small problem, but it made me
think...

How about requiring that a Realm is specified along with the
Null challenge; this way, if a UA receives multiple challenges
(say due to a forking proxy), it will potentially be able to
pick a preferred Realm that it has no credentials for?

 - Jo.

---

From: Henning Schulzrinne <[email-masked]>
Date: Tue, 26 Sep 2000 09:12:20 -0400

Jonathan Rosenberg wrote:

> null case helps distinguish.

And to do this without keeping state.
-- 
Henning Schulzrinne   http://www.cs.columbia.edu/~hgs

---

From: Henning Schulzrinne <[email-masked]>
Date: Tue, 26 Sep 2000 09:44:27 -0400

> pick a preferred Realm that it has no credentials for?

Indeed, I missed the sentence in 2617 that says

The authentication parameter realm is defined for all authentication
   schemes ...

Not sure what a realm means here, but it would allow to do something
like

realm="For unauthenticated calls"

I added this to the text.