Subject: RE: [Sip] draft-ietf-sip-asserted-identity-02.txt: ppi from trust ed entity

From: "Mark Watson" <[email-masked]>
Date: Wed, 30 Oct 2002 13:43:39 -0000

Harsh,

From memory, a proxy should not expect to receive P-Preferred-Identity from
another member of the Trust Domain for Asserted Identity.

You may be right that the behaviour if it is received is not specified. If a
P-Asserted-Identity is present, then I would expect the P-Preferred-Identity
to be discarded (they should not coexist). If there is no
P-Asserted-Identity, then I suppose the Proxy could behave as if the message
were received from outside the Trust Domain...

If P-Preferred-Identity is received from outside the Trust Domain, the proxy
attempts to authenticate the originator of the message.

You ask whether the proxy MAY or MUST use the P-Preferred-Identity, but I'm
not sure the question makes sense. If it were a MAY, then whether to use it
or not must be a matter of local policy for the proxy. If it were a MUST,
then as long as the P-Preferred-Identity is 'a valid identity for that user'
then it MUST use it. But the list of 'valid identities for that user' is a
matter of local policy too. So there is no difference.

For example, if the proxy NEVER uses P-Preferred-Identity, then this is
equivalent to saying that there is only one valid identity for the user.

Regards,

Mark Watson

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]
> Sent: 29 October 2002 05:30
> To: [email-masked]
> Cc: [email-masked]
> Subject: [Sip] draft-ietf-sip-asserted-identity-02.txt: ppi 
> from trusted
> entity
> 
> 
> 
> 
> Hi,
> 
> Section 6 does not seem to explicitely specify proxy's behaviour when
> p-preferred-identity header is received by a proxy from a 
> trusted entity:
> 
> a)preferred identity corresponds to a valid identify known to 
> the proxy for
> that user.
> -MUST the proxy use this identity or  MAY it ? I assume it MUST.
> b)preferred identity does not correspond to a valid identity 
> known to the
> proxy for that user.
> -Should the proxy behaviour be same as when the entity from which the
> header was received is not trusted.
> 
> 
> thanks
> harsh
> 
> 
> 
> 
> 
> 
> 
> 
> This message is proprietary to Hughes Software Systems 
> Limited (HSS) and is
> intended solely for the use of the individual to whom it is 
> addressed.  It
> may contain privileged or confidential information and should not be
> circulated or used for any purpose other than for what it is 
> intended.  If
> you have received this message in error, please notify the originator
> immediately.  If you are not the intended recipient, you are 
> notified that
> you are strictly prohibited from using, copying, altering, or 
> disclosing
> the contents of this message.  HSS accepts no responsibility 
> for loss or
> damage arising from the use of the information transmitted by 
> this email
> including damage from virus.
> 
> 
> _______________________________________________
> Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
> This list is for NEW development of the core SIP Protocol
> Use [email-masked] for questions on current sip
> Use [email-masked] for new developments on the application of sip
>

---

From: [email-masked]
Date: Thu, 31 Oct 2002 09:27:40 +0530

Mark,

I understand the point that you've made and that  how a proxy uses the
P-Preferred-Identity headers
received from a user agent is a policy decision.

I got confused because of the first statement in Section 6 which reads:
'If a P-Preferred-Identity header field is present in the message that
   a proxy receives from an entity that it does not trust.....'.

Is this statement then equivalent to the following?
'If a P-Preferred-Identity header field is present in the message that
   a proxy receives from a user agent.....'.

I was also trying to understand why the P-Preferred-Identity MUST be
removed
by a proxy from any message that it forwards.Would it be correct to say
that the reason lies in
requirments themselves, as put forward in
draft-ietf-sipping-nai-reqs-02.txt , section 3 of which reads

'It shall be possible for a UA to provide a preferred identity to the
   network intermediary, which MAY be used to inform the generation of
   the Network Asserted Identity according to the policies of the Trust
   Domain.'.

And therefore the significance of P-Preferred-Identity exists only between
a UA and the proxy that performs its authentication.

thanks
harsh

"Mark Watson" <[email-masked]> on 10/30/2002 07:13:39 PM

To:   Harsh Bhondwe/HSSBLR, [email-masked]
cc:

Subject:  RE: [Sip] draft-ietf-sip-asserted-identity-02.txt: ppi from trust
      ed entity

Harsh,

You may be right that the behaviour if it is received is not specified. If
a
P-Asserted-Identity is present, then I would expect the
P-Preferred-Identity
to be discarded (they should not coexist). If there is no
P-Asserted-Identity, then I suppose the Proxy could behave as if the
message
were received from outside the Trust Domain...

If P-Preferred-Identity is received from outside the Trust Domain, the
proxy
attempts to authenticate the originator of the message.

then as long as the P-Preferred-Identity is 'a valid identity for that
user'

Regards,

Mark Watson

---

From: "Mark Watson" <[email-masked]>
Date: Thu, 31 Oct 2002 13:06:24 -0000

Harsh,

See comments inline...

> Sent: 31 October 2002 03:58
> To: Watson, Mark [MOP:EP10:EXCH]
> Cc: [email-masked]; [email-masked]
> Subject: RE: [Sip] draft-ietf-sip-asserted-identity-02.txt: ppi from
> trust ed entity
> 
> 
> 
> 
> Mark,
> 

No, in this draft 'an entity that [the proxy] does not trust' formally means
'an entity outside the Trust Domain for Asserted Identity of which the proxy
is a member'.

Normal User Agents will usually be outside the Trust Domain. But a User
Agent such as a PSTN gateway may be inside the Trust Domain.

Another proxy could be either inside or outside the Trust Domain. The
requirements that have to be met for another proxy to be considered inside
the Trust Domain are defined in the definition of a particular Trust Domain
(called Spec(T)). The minimum things that Spec(T) has to include to make the
mechanism work are described in the drafts.

> a UA and the proxy that performs its authentication.

Yes.