Subject: 答复: RE: [Sip] one question on the authentication for third-party registration

From: [email-masked]
Date: Tue, 13 Dec 2005 09:47:07 +0800

Hi Kasturi，

Thanks for your reply. 

There is a mistake in the example, then user-info in Contact uri should be 
"alice" not "bob".

My confusion is the username of the credential not the Contact in 
REGISTER. I think the username of the credential should be "bob" since the 
originator of REGISTER is bob, but RFC3261 Section 26.3.2.1 (page 243) 
said that username of this credential 
SHOULD correspond with the "userinfo" portion of the URI in the To header 
field of the REGISTER request.

Best Regards, 
LionEagle 

"Kasturi Narayanan" <[email-masked]>

2005-12-13 上午 09:20
 
        收件人：        <[email-masked]>, <[email-masked]>
        抄送： 
        主题：  RE: [Sip] one question on the authentication for 
third-partyregistration

Ideally the intention is to authenticate the originator of the Register 
regardless of whom that person is registering.
Once authenticated there may be authorization needed (local policy) 
regarding whom all this person can register if the person to be registered 
is a valid user of this network.
So authentication is done for the originator of the request. 
 
And also in your example if Alice is being registered u may want the 
contact to look like [email-masked] unless u intentionally meant that.
 
If what u mentioned below is true then it needs to be looked into.
 
Kasturi

From: [email-masked] [mailto:[email-masked]] On Behalf Of 
[email-masked]
Sent: Monday, December 12, 2005 7:07 PM
To: [email-masked]
Subject: [Sip] one question on the authentication for 
third-partyregistration

Hi, 

I am confused by the authentication for third-party registration. 

We assume that Bob registrers for Alice, so the REGISTER request may be 
like this: 

REGISTER sip:registrar.biloxi.com SIP/2.0 
Via: SIP/2.0/UDP bobspc.biloxi.com:5060;branch=z9hG4bKnashds7 
Max-Forwards: 70 
To: Alice <sip:[email-masked]> 
From: Bob <sip:[email-masked]>;tag=456248 
Call-ID: 843817637684230@998sdasdh09 
CSeq: 1826 REGISTER 
Contact: <sip:[email-masked]> 
Expires: 7200 
Content-Length: 0 

As RFC3261 Section 10.3 (page 64) described, registrar SHOULD authenticate 
the UAC using 
the mechanisms described in RFC3261 Section 22, so the username of the 
credential should 
be "bob", while RFC3261 Section 26.3.2.1 (page 243) said that username of 
this credential 
SHOULD correspond with the "userinfo" portion of the URI in the To header 
field of the 
REGISTER request, that is "alice", this means authentication is for Alice, 
not Bob. 

Which one is the correct? 

Best Regards, 
LionEagle 

***********************************************
d?!f/e. e(e#0f
o<

ZTEe/9h/%i[1].d;6f
%f f f f e)c[1]h/7f
%f6hf3(f 
d?e/o<
f*g;ed;6d::d9&i"h.8e/oed;;d=g,,
d8 f9g; g;e
d8*d::ii2f,i[1].d;6f e+d?!f/g e(i (
fi (ec[1]d;%d8 e#0f
d;i[1]g(d:
e7%d=i[1].d;6c
Information Security  Noticeo<
The information contained in this mail is
solely property of  ZTE Corporation. 
This mail communication is confidential.
Recipients named above are obligated to
maintain secrecy and are not permitted to
disclose the contents of this communication
to others.
***********************************************

************************************************
The email has  been scanned by Anti-Spam
system,  if you find Spam or Virus in this mail,
please forward it to: [email-masked]
************************************************

***********************************************
信息安全声明：本邮件包含信息归ZTE所有，
ZTE对该邮件拥有所有权利。请接收者注意
保密，未经发件人书面许可，不得向任何第
三方组织和个人透露本邮件所含信息的全部
或部分。以上声明仅适用于工作邮件。
Information Security  Notice：
The information contained in this mail is
solely property of  ZTE Corporation. 
This mail communication is confidential.
Recipients named above are obligated to
maintain secrecy and are not permitted to
disclose the contents of this communication
to others.
***********************************************
_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: "Dale R. Worley" <[email-masked]>
Date: Tue, 13 Dec 2005 16:32:58 -0500

On Tue, 2005-12-13 at 09:47 +0800, [email-masked] wrote:
> REGISTER. I think the username of the credential should be "bob" since
> the originator of REGISTER is bob, but RFC3261 Section 26.3.2.1 (page
> 243) said that username of this credential 
> SHOULD correspond with the "userinfo" portion of the URI in the To
> header field of the REGISTER request. 

There is no single answer, as it depends on local policy -- What
credentials does a request have to present in order to be allowed to
modify the bindings for alice@...?

A safe choice seems to be "the UA must present alice's credentials".
But that might not work, or it might not be desirable for bob to have
alice's credentials.  But in order for bob's credentials to be adequate
to update alice's bindings, the registrar needs to know which
credentials are sufficient for modifying which bindings.

Dale

---

From: Mahesh Govind <[email-masked]>
Date: Wed, 14 Dec 2005 09:44:13 +0900

Hi,
If the protocol is not providing a fool proof mechanism  for third party
registrations , will it lead to hacking ?

-mahesh

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Dale
R. Worley
Sent: Wednesday, December 14, 2005 6:33 AM
To: Sip
Subject: Re: 答?: RE: [Sip] one question on the authentication for
third-party registration

Dale

---

From: "Dale R. Worley" <[email-masked]>
Date: Wed, 14 Dec 2005 10:28:46 -0500

> registrations , will it lead to hacking ?

My point is that the critical factor isn't the protocol, but the
registrar.  If the registrar does not have sound policies, it can be
hacked.  If the registrar does not allow third-party registrations, and
validates all request credentials against the sender name, then it can
in a sense "depend on the protocol".  Otherwise, the registrar's
policies are crucial.

Dale

---

From: Paul Kyzivat <[email-masked]>
Date: Wed, 14 Dec 2005 11:28:09 -0500

This should be considered a two step process:

1) the requestor is authenticated. The From header
    may or may not have anything to do with this.
    The end result of this is that the registrar
    should know "this is Bob requesting to register".

2) the request is authorized. The question to be
    answered is: "is Bob permitted to register using
    Alice's AOR?" A simple answer to this might be:
    "NO - only alice may register for Alice." A more
    flexible registrar may have an ACL for each AOR
    specifying who may register to it. It might say
    "both Alice and Bob may register for Alice".

Both of these steps are driven by policy in the registrar, and not 
specified by the sip standards. (An authentication *mechanism* - digest 
- is specified. But it doesn't say anything about *who* can successfully 
authenticate, nor does it say whether this has anything to do with the 
contents of the From header.)

	Paul

---

From: Cullen Jennings <[email-masked]>
Date: Wed, 14 Dec 2005 16:45:49 -0800

Has anyone build a proxy that allows the configuration of a policy that says
Bob is allowed to register for Alice's AOR?

---

From: Mahesh Govind <[email-masked]>
Date: Thu, 15 Dec 2005 10:41:04 +0900

HI,
I have one more query related to this .
In such cases can I expect 100% interoperability.
Will I be able to buy a sip phone from market and 
do a third party registration successfully , with any operator ?
If a registrar rejects a request, what exact reason it will give?

-Mahesh

---

From: "Dale R. Worley" <[email-masked]>
Date: Wed, 14 Dec 2005 23:38:50 -0500

> do a third party registration successfully , with any operator ?

I do not recall any phone that does third-party registrations.

> If a registrar rejects a request, what exact reason it will give?

Some SIP agents give reasons when they return an error, but most do not.

Dale

---

From: Paul Kyzivat <[email-masked]>
Date: Thu, 15 Dec 2005 00:06:18 -0500

I'm not aware of any. But I've been discussing use cases for it for 
years. One is for a boss/secretary arrangement, where the secretary can 
register for the boss' AOR, but doesn't need the boss' own credentials 
to do it.

Somebody has to be first. Go for it!

	Paul

---

From: Klaus Darilion <[email-masked]>
Date: Thu, 15 Dec 2005 11:46:18 +0100

> Bob is allowed to register for Alice's AOR?

I never did it yet, but I'm sure this can be done with openser (using 
pseudo variables and the AVPOPS module)

regards
klaus

---

From: Jonathan Rosenberg <[email-masked]>
Date: Thu, 15 Dec 2005 09:53:51 -0500

I think these use cases are better handled through configuration of a 
forwarding feature that runs on the proxy. I had always envisioned xcap 
being used for this kind of thing too; we need only define schema for 
the forwarding numbers.

Note that, with draft-ietf-sip-outbound, third-party registrations are 
not possible anymore. I think thats a good thing; it allows us to 
separate routing from retargeting, per the discussion we had at ietf.

-Jonathan R.

-- 
Jonathan D. Rosenberg, Ph.D.                   600 Lanidex Plaza
Cisco Fellow                                   Parsippany, NJ 07054-2711
Cisco Systems
[email-masked]                              FAX:   (973) 952-5050
http://www.jdrosen.net                         PHONE: (973) 952-5000
http://www.cisco.com

---

From: Jan Janak <[email-masked]>
Date: Thu, 15 Dec 2005 18:24:55 +0100

> Somebody has to be first. Go for it!

  SER ( http://iptel.org/ser ) supports this. It was developed exactly
  for the scenario described above -- to have the possibility to register
  the AoR of someone else without having his/her credentials.

    Jan.