Subject: [SIP] Re: Open issue with Quotes in WWW-Authenticate ??

From: Jonathan Rosenberg <[email-masked]>
Date: Sun, 03 Sep 2000 01:12:03 -0400

The problem is in rfc2617, which is inconsistent in the usage of quoted
strings for certain parameters, namely the uri. The BNF is clear in that
it is not quoted:

> 3.2.2 The Authorization Request Header
> 
>    The client is expected to retry the request, passing an Authorization
>    header line, which is defined according to the framework above,
>    utilized as follows.
> 
>        credentials      = "Digest" digest-response
>        digest-response  = 1#( username | realm | nonce | digest-uri
>                        | response | [ algorithm ] | [cnonce] |
>                        [opaque] | [message-qop] |
>                            [nonce-count]  | [auth-param] )
> 
>        username         = "username" "=" username-value
>        username-value   = quoted-string
>        digest-uri       = "uri" "=" digest-uri-value
>        digest-uri-value = request-uri   ; As specified by HTTP/1.1

but the examples show the uri value to be a quoted string:

> Authorization: Digest username="Mufasa",
>                  realm="[email-masked]",
>                  nonce="dcd98b7102dd2f0e8b11d0f600bfb0c093",
>                  uri="/dir/index.html",
>                  qop=auth,
>                  nc=00000001,
>                  cnonce="0a4f113b",
>                  response="6629fae49393a05397450978507c4ef1",
>                  opaque="5ccc069c403ebaf9f0171e9517f40e41"
> 

So, the issue is which one to use. Common usage appears to be quoted, so
the proposal is to go with that.

-Jonathan R.

Phil Hoffer wrote:
> 
> Hi Jonathan,
> 
> In your SIP ML Open Issues presentation for IETF48 ....
> 
> http://www.softarmor.com/sipwg/meets/IETF48/slides/pres-rosenburg-sipwg_jul0
> 0_listissues.ppt
> 
> the last slide mentions "Quotes in WWW-Authenticate" and details....
> 
> <quote>
> 
> BNF and examples for params in WWW-Authenticate inconsistent in http
> Do we use quotes or not?
> Proposal:
>     Quotes
> 
> </quote>
> 
> I'm confused with this slide as I'm unaware of an open issue in this area.
> The BNF is quite clear, however the examples given in "SIP Telephony Call
> Flow Examples"
> (http://search.ietf.org/internet-drafts/draft-ietf-sip-call-flows-01.txt)
> are inconsistent with the SIP specification.
> This might have led to the confusion which appears to surround the four
> headers used for authentication.
> 
> I can appreciate that there is some scope for lenient parsing of the
> parameters in the authentication related headers, but as far as I'm
> concerned the spec seems fine.
> 
> Can you clear up my confusion?
> 
> Thanks In Advance
> Phil Hoffer
> 
> http://www.ubiquity.net

-- 
Jonathan D. Rosenberg                       72 Eagle Rock Ave.
Chief Scientist                             First Floor
dynamicsoft                                 East Hanover, NJ 07936
[email-masked]                     FAX:   (973) 952-5050
http://www.cs.columbia.edu/~jdrosen         PHONE: (732) 741-7244
http://www.dynamicsoft.com

_______________________________________________
SIP mailing list
[email-masked]
http://lists.bell-labs.com/mailman/listinfo/sip

---

From: "Phil Hoffer" <[email-masked]>
Date: Mon, 4 Sep 2000 10:10:35 +0100

----- Original Message -----
From: Jonathan Rosenberg <[email-masked]>
To: Phil Hoffer <[email-masked]>
Cc: <[email-masked]>
Sent: Sunday, September 03, 2000 6:12 AM
Subject: Re: Open issue with Quotes in WWW-Authenticate ??

Hi Jonathan,

My understanding was that a vote was taken at the 4th bakeoff, and it was
decided that quotes MUST be used. In fact in Section 14.3 Digest
Authentication in rfc2543bis, subsection 2 it talks about the inconsistency
in rfc2617 and states that "For SIP, the URI MUST be enclosed in quotation
marks".

So it appears that this is a closed issue.

From the bakeoffs, it would appear that the main areas of confusion wrt
authentication appear to be the quoting of the qop parameter in the
response, and the general quoting/non-quoting of the other parameters in the
authetication headers.

To add to the confusion the authentication headers in the SIP Telephony Call
Flow Examples, draft-ietf-sip-call-flows-01.txt, are inconsistent with the
rfc2543bis and rfc2617 and MUST be corrected, as they are bound to add to
the confusion in their current state.

Regards
Phil Hoffer

http://www.ubiquity.net