Subject: [Sip] RE: Comment on sip-identity-00

From: "Peterson, Jon" <[email-masked]>
Date: Mon, 13 May 2002 11:24:24 -0500

These are good points; throughout the identity draft, I tried to use Digest
only as an example, and indeed in plenty of authentication systems the
identifier of a user would not be suitable syntactically or semantically for
the username portion of a SIP URI. I do think it is not unreasonable,
however, in systems like Digest for a user to have an expectation that the
username they enter into an authentication dialog (for example) will be the
username that appears in their authenticated identity. However, there is as
you suggest no need for this to be mandated normatively by the standard.
Perhaps we could add some language to 4.2 that would explain some of these
issues.

Jon Peterson
NeuStar, Inc.

> -----Original Message-----
> From: Robert Sparks [mailto:[email-masked]]
> Sent: Friday, May 10, 2002 12:58 PM
> To: [email-masked]; Jon Peterson
> Subject: Comment on sip-identity-00
> 
> 
> Paragraph 2 of 4.2 binds the username part of
> credentials (such as DIGEST credentials) to an
> identity represented as a SIP URI by algorithmically
> placing that username into the user portion of the URI.
> 
> This instead should be policy at the authentication
> service. That service knows how to bind whatever
> credentials it was given to an identity. Presumably,
> since it is a SIP identity service, it knows how to
> express that identity as a SIP URI.
> 
> Using the algorithm suggested will create problems
> for existing realms where the username "alice" is
> owned by someone other than the person who owns
> "[email-masked]". It also wouldn't work for 
> other credentialing methods where the analog of
> username isn't syntactically valid for the user 
> portion of a SIP URI.
> 
> RjS
> 
> 
> 

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: [email-masked]
Date: Tue, 14 May 2002 07:35:04 +0300

Peterson, Jon writes:

 > username that appears in their authenticated identity.

i tried to make this same point.  in our case the username used in
digest authentication is the general NAI (Network Access Identifier) of
the user and the sip network asserted identity i-d cannot that the
username used in the digest authentication (or any other authentication
scheme) has nothing to do with the sip uris the user may have.  the i-d
should make this requirement explicitly clear and also clearly explain
that what is asserted is the sip uri the user wants to use for this
request.

-- juha