Subject: [Sip] Question on basic authentication of SIP

From: "Wei BJ Lu" <[email-masked]>
Date: Wed, 29 Aug 2001 17:06:07 +0800

Hi, I have a question on basic authentication of SIP.

To my understanding, SIP uses the HTTP basic and digest authentication
mechanism.
When using basic authentication, the server will chanllenge client with a
"realm"
parameter to indicate which server is in need of authentication. But the
client
only need to provide encoded form of "username:password" in credential.
Since
a SIP request may pass more than one server before it reaches the
destination
and all servers could require authentication, so a SIP request may contain
more
than one credentials. The result is that a server cannot distinguish which
credential
is corresponding to the chanllenge sent by it.

I do not know whether there is already some ways to solve this problem. For
the time
being, I just let the server to compare all the passwords in all the
credentials with
passwords stored at server. But it is not efficient. My opinion is maybe we
could
add a "realm" parameter in credentials of basic authentication. Although
this will
bring difference between SIP and HTTP basic authentication, I think it is
necessary
if we consider the difference between SIP and HTTP --- a HTTP request will
only pass(reach)
one HTTP server while a SIP request will probably pass more than one SIP
server.

Dr. Lu Wei
Staff Research Member, Infrastructure Technology
IBM China Research Lab.
4/F, HaoHai Building, No.7, 5th Street, Shangdi, Beijing 100085
Phone: (8610)62986677-549   Tie-line: 905-549   Fax:
(8610)82899633/82899634
Email:  [email-masked]

_______________________________________________
Sip mailing list  http://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip