Subject: [Sip] Re: [Simple] Usage of Contact header in PUBLISH for applicationauthentication ?

From: Mauricio Arango <[email-masked]>
Date: Thu, 21 Oct 2004 13:35:39 -0400

Use of TLS between the app server and the presence
server seems to assume that the PUBLISH request isn't
routed through multiple intermediate SIP proxies, which
shouldn't be a valid assumption even when both
the app server and the presence server are in the
same administrative domain.

I believe the problem of a presence server
authenticating the source of a PUBLISH request
(application server) is provided in in draft-ietf-sip-identity-03.

The other question you pose is how does the application
server can authenticate the source of presence the information
it collects. If the app server is in turn a SIMPLE presence
server, then the approach in draft-ietf-sip-identity-03
can also be applied to its presence sources. If it isn't then
a similar approach should be proposed via the use of
authentication assertions granted by an authentication provider
with which the presence sources authenticate.

Mauricio Arango

CORVOYSIER David RD-MAPS-REN wrote:

> I'm jumping into that thread because the use case described by bernhard is one of those I am also struggling with (presence published on behalf of a presentity) ...
>
> So, from your answer I understand that TLS will authenticate the application server towards the presence server, but does this also mean that the presence server delegates user authentication to the application server ?
> In that case how can the application server be sure that the user is allowed to publish presence for the presentity ? I am probably missing something but it seems to me that without some kind of control a user authenticated by the app server could possibly publish presence for anyone ...
>
> --------------------------------
> David Corvoysier
> France Telecom R&D
> http://www.rd.francetelecom.com/
> --------------------------------
>
> > -----Message d'origine-----
> > De : [email-masked] [mailto:[email-masked]]
> > De la part de Jonathan Rosenberg
> > Envoyé : jeudi 21 octobre 2004 05:24
> > À : Boehmer Bernhard ICM Berlin
> > Cc : 'Aki Niemi'; SIMPLE WG
> > Objet : Re: AW: [Simple] Usage of Contact header in PUBLISH
> > for applicationa uthentication ?
> >
> > For cases where an application server is publishing, the
> > right thing is to use mutual TLS between the application
> > server and the presence server. The TLS certificates indicate
> > the identity of the element generating the publish. There is
> > no need for p-a-id here; the presence document would contain
> > the identity of the presentity. Authorization policies in the
> > presence server would typically make sure that the given
> > application server can publish state for that presentity.
> >
>
> _______________________________________________
> Simple mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/simple

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip