Subject: Re: [BEHAVE] Some questions regarding RFC5766(TURN) authentication

From: "Tirumaleswar Reddy (tireddy)" <[email-masked]>
Date: Tue, 13 Nov 2012 04:51:38 +0000

Hi Wilson,

In enterprise deployments for webrtc calls TURN server is required to audit all media sessions from inside the company premises to any external peer (http://tools.ietf.org/html/draft-ietf-rtcweb-use-cases-and-requirements-09). Hence this will be a important scenario to consider for Enterprise deployments. PANA (RFC 5191) can be used to solve the problem for both STUN/TURN servers deployed in Enterprise premises. Using PANA for other protocols like PCP is already being discussed in PCP WG.

--Tiru.
From: chen wilson [mailto:[email-masked]]
Sent: Wednesday, October 31, 2012 3:07 AM
To: [email-masked]
Subject: [BEHAVE] Some questions regarding RFC5766(TURN) authentication

RFC5389(STUN) section 10 provides 2 ways to do authentication and
integrity check while RFC 5766 only supports long-term credential.
My question is how to integrate the long-term credential with SSO,
for example, SAML mechanism?

2 typical user cases in my mind are:
1. Deploy TURN in enterprise just like HTTP proxy, in such a case,
it would be better to authenticate with enterprise Active Directory;
2. Deploy TURN as a cloud service, the service providers would
always have their own unified authentication server.
Are these 2 user cases typical for TURN?

Thanks,
Wilson Chen

---

From: chen wilson <[email-masked]>
Date: Fri, 16 Nov 2012 16:56:41 +0800

Thanks Tiru,

I take a look at the PANA, it didn't clear my confusion.
My real headache is TURN needs to generate long-term credential attribute,
it requires a username and password, how to choose the username?
In enterprise, I have a domain account with realm -- that is my windows
credential. I would like user to use that credential, but the TURN server
is most likely to be deployed in DMZ, AD-DS is always in internal network,
so how can TURN get the username and password to verify my TURN
authentication attribute?

Thanks,
Wilson Chen

On Tue, Nov 13, 2012 at 12:51 PM, Tirumaleswar Reddy (tireddy) <
[email-masked]> wrote:

>  Hi Wilson,****
>
> ** **
>
> In enterprise deployments for webrtc calls TURN server is required to audit all media sessions from inside the company premises to any external peer (http://tools.ietf.org/html/draft-ietf-rtcweb-use-cases-and-requirements-09). Hence this will be a important scenario to consider for Enterprise deployments. PANA (RFC 5191) can be used to solve the problem for both STUN/TURN servers deployed in Enterprise premises. Using PANA for other protocols like PCP is already being discussed in PCP WG. ****
>
> ** **
>
> --Tiru.****
>
> *From:* chen wilson [mailto:[email-masked]]
> *Sent:* Wednesday, October 31, 2012 3:07 AM
> *To:* [email-masked]
> *Subject:* [BEHAVE] Some questions regarding RFC5766(TURN) authentication*
> ***
>
> ** **
>
> RFC5389(STUN) section 10 provides 2 ways to do authentication and ****
>
> integrity check while RFC 5766 only supports long-term credential.****
>
> My question is how to integrate the long-term credential with SSO, ****
>
> for example, SAML mechanism?****
>
> ** **
>
> 2 typical user cases in my mind are:****
>
> 1. Deploy TURN in enterprise just like HTTP proxy, in such a case, ****
>
> it would be better to authenticate with enterprise Active Directory;****
>
> 2. Deploy TURN as a cloud service, the service providers would ****
>
> always have their own unified authentication server.****
>
> Are these 2 user cases typical for TURN?****
>
> ** **
>
> Thanks,****
>
> Wilson Chen****
>
> ** **
>