Subject: [Sip] Open Issue #81: caching of proxy credentials

From: Jonathan Rosenberg <[email-masked]>
Date: Wed, 5 Dec 2001 16:43:27 -0500

Issue:

The spec talks about caching of proxy-authorization credentials. However,
the 
wording is really vague about how a proxy would know whether or not a given 
request should use a specific credential. We need to give a concise, 
algorithmic formula for a UA to determine which credentials to place into a 
request. 

Points of discussion:

Even if its not done correctly, things still work; it just may take some
time to go through the challenges again. As such, it is worthwhile to come
up with a solution that covers the most common cases. The most common cases
where caching will be useful are (1) requests within a dialog, where you
want to reuse the credentials for proxies along the chain of proxies in the
route set, and (2) local outbound proxies, where you want to use credentials
for your local outbound proxy even for requests for a new dialog.

Its worth noting that we have a similar issue with the session timer in
dealing with issue (1). The Min-SE header is cached for the duration of a
dialog. Things get complex in that case, and here too, since the set of
proxies which see the initial INVITE might not be the same set which are on
the route set for the established dialog. As a result of that, session timer
recommends effectively flushing your cache once the dialog is established,
so you get a fresh Min-SE. However, in the case here, the odds of being
rejected without this cache are 100%, as opposed to there, where its much
smaller. So, I am not sure we can afford this luxury.

Now, the complexity with (2) is knowing WHICH credential corresponds to the
one for your local outbound proxy. This can either be configured, or it will
generally be the first challenge you receive.

Of course, UA's could even be smart about guessing which credentials to
include; the penalty for including the wrong ones is not high, I don't
think, unless you are trying to maintain privacy, in which case they do
reveal your username. But, thats an issue for the privacy specs to worry
about.

Proposal:

UA MAY cache credentials in any way it likes.

The following rule, however, is RECOMMENDED:

   * If a UA receives a Proxy-Authenticate in a 401/407 to a request with a
particular Call-ID, it includes credentials for that realm in all subsequent
requests that contain the same Call-ID. By definition of the Call-ID, these
won't be cached across dialogs. However, this does mean a request could
contain credentials that are not needed at any proxy along the path.

The following rules MAY be followed as a simple but reasonable approach:

   * The UA is configured with the realm of its local outbound proxy, when
one exists, and the UA caches credentials for that realm across dialogs. 

   * If a UA receives a WWW-Authenticate in a 401/407 to a request with a
particular To URI, it reuses that credential in any subsequent request to
the same To URI.

-Jonathan R.

---
Jonathan D. Rosenberg, Ph.D.                72 Eagle Rock Ave.
Chief Scientist                             First Floor
dynamicsoft                                 East Hanover, NJ 07936
[email-masked]                     FAX:   (973) 952-5050
http://www.jdrosen.net                      PHONE: (973) 952-5000
http://www.dynamicsoft.com

_______________________________________________
Sip mailing list  http://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Jonathan Rosenberg <[email-masked]>
Date: Thu, 27 Dec 2001 11:16:45 -0500

There were no comments on this proposal. I will interpret silence as 
consensus. Text on caching of credentials will be incorporated into bis.

-Jonathan R.

-- 
Jonathan D. Rosenberg, Ph.D.            72 Eagle Rock Avenue
Chief Scientist                         First Floor
dynamicsoft                             East Hanover, NJ 07936
[email-masked]                 FAX: (973) 952-5050
http://www.jdrosen.net                  PH:  (973) 952-5000
http://www.dynamicsoft.com