Subject: [Sip] Comment on sip-identity-00

From: Robert Sparks <[email-masked]>
Date: 10 May 2002 14:58:23 -0500

Paragraph 2 of 4.2 binds the username part of
credentials (such as DIGEST credentials) to an
identity represented as a SIP URI by algorithmically
placing that username into the user portion of the URI.

This instead should be policy at the authentication
service. That service knows how to bind whatever
credentials it was given to an identity. Presumably,
since it is a SIP identity service, it knows how to
express that identity as a SIP URI.

Using the algorithm suggested will create problems
for existing realms where the username "alice" is
owned by someone other than the person who owns
"[email-masked]". It also wouldn't work for 
other credentialing methods where the analog of
username isn't syntactically valid for the user 
portion of a SIP URI.

RjS

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: [email-masked]
Date: Sat, 11 May 2002 08:48:57 +0300

there seems to be lots of confusion about what "authenticated identity"
of a sip user is.  in our network it is simply the Network Access
Identity (NAI) of the user, e.g., [email-masked].  that same NAI is used
for all services the user has subscribed to, e.g., email, remote access,
and sip, and thus is not sip specific.

the NAI does necessarily have NOTHING to do with the sip uri that the
user registers and want to be known by.  for example, the user with NAI
[email-masked] may want to register a sip uri sip:[email-masked] or
several sip uris of that or other sort.  the user specifically may NOT
want to register as sip:[email-masked].

my conclusion of all this is that the authentication server must verify
both the NAI of the user and the sip uri of the user that the user has
placed in the from header or, in case of an anonymous call, in some
other header of the message.  it seems to me that for the other parties
to which the message is forwarded to, it is enough that the
authenticated sip uri is included in the message.

regarding the i-d on the subject line, the distinction between the NAI
and sip uris of the user should be clarified before we can go on.

-- juha