Subject: [Sip] Open Issue #131: Meaning of challenge when UAC is a gateway

From: Jonathan Rosenberg <[email-masked]>
Date: Wed, 5 Dec 2001 22:01:09 -0500

Issue:

When a UAS or proxy challenges a UAC that is a PSTN gateway, is the
challenge for the gateway, or the user calling through the gateway? In the
latter case, for example, the gateway might prompt the user, with voice
prompts, to enter a password or something.

Discussion points:

A similar issue can arise for a standalone sip phone; is the challenge for
the device or the user on the device? As a general rule, realms are the way
to identify for whom the challenge is requested. A device would need to be
programmed with the realm for which it has credentials as a device. Should
it receive a challenge for that realm, the device could supply credentials.
Challenges for other realms would go to the user, since whether they are for
the device or the user, the device can't answer them anyway, so may as well
try the user.

Proposal:

Add wording that talks about this realms usage.

-Jonathan R.

---
Jonathan D. Rosenberg, Ph.D.                72 Eagle Rock Ave.
Chief Scientist                             First Floor
dynamicsoft                                 East Hanover, NJ 07936
[email-masked]                     FAX:   (973) 952-5050
http://www.jdrosen.net                      PHONE: (973) 952-5000
http://www.dynamicsoft.com

_______________________________________________
Sip mailing list  http://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Michael Thomas <[email-masked]>
Date: Thu, 6 Dec 2001 09:38:41 -0800 (PST)

> prompts, to enter a password or something.

   Drawing distinctions between user and devices is, IMO,
   pointless. The box should first check to see if it has
   the ability to fulfill the challenge itself, and only
   if it cannot should it prompt the user. I agree, allow
   the realm to be the differentiator. If it's possible, 
   I'd lose any mention of user/device since the suggestion
   of dichotomy causes people to go down the wrong road.

		Mike

---

From: "Henning G. Schulzrinne" <[email-masked]>
Date: Thu, 06 Dec 2001 13:03:55 -0500

>    of dichotomy causes people to go down the wrong road.

I agree with Mike. Web browsers do the same thing - they check if they
have cached the appropriate secret and send it without further
intervention. If the realm is unknown, they use the realm as a user
prompt to get the user name and password. Presumably, a sufficiently
smart gateway could render the realm via text-to-speech, but that's not
something we need to worry about.

-- 
Henning Schulzrinne   http://www.cs.columbia.edu/~hgs