Subject: [Sipping] Comments on draft-calhoun-sip-aaa-reqs-04.txt

From: "Carolina Canales Valenzuela (ECE)" <[email-masked]>
Date: Thu, 21 Mar 2002 12:28:26 +0100

Hi,
some comments to the SIP-AAA requirements draft, v.4 (draft-calhoun-sip-aaa-reqs-04.txt):

*Sect 2.2: It just considers the AAA user authentication at the point when the REGISTER message is sent by the HSP. However, I think it should also be considered the case when the AAA performs the authentication upon a REGISTER message coming *from the SSP*. In order to allow this, paragraph #13, which reads:

"If the AAAH has authenticated the client the Serving SIP Proxy in the
 home network will then responds back to the Home entry SIP Proxy with
 a 200 OK message, which is proxied back all the way to the user.

   If the authentication of the SIP client is instead handled by the
   Serving SIP Proxy in the home network, the Serving SIP Proxy in the
   home network MAY decide that a challenge-response procedure is
   appropriate, and MAY issue a 401 (Unauthorized) response, including
   the challenge. The SIP client would calculate the answer to the
   challenge and would have to re-register and if granted, then the
   Serving SIP Proxy in the home network will send back a 200 OK message."

should be:

"If the AAAH has authenticated the client the Serving SIP Proxy in the
home network will then responds back to the Home entry SIP Proxy with
a 200 OK message, which is proxied back all the way to the user.

If the authentication of the SIP client is instead handled by the
Serving SIP Proxy in the home network, the Serving SIP Proxy in the
home network MAY decide that a challenge-response procedure is 
appropriate, and MAY issue a 401 (Unauthorized) response, including
the challenge. The SIP client would calculate the answer to the
challenge and would have to re-register and if granted, then the
Serving SIP Proxy in the home network will send back a 200 OK message.
   
This same procedure would be also followed in case the authentication 
is performed by the AAAH server, at the moment when the SSP asks the AAAH to update the 
DSI database and register its name as the SIP server for that user (SSP chosen by the HSP)"

*Sect 2.3.1 (general): Perhaps some paragraphs could be added, in order to contemplate the case of unregistered users but with associated services. E.g when the user is not registered but the terminating call is deviated to a voice mailbox.

*Sect 2.3.2, 2nd paragraph: In order to introduce the requirement for authenticated INVITEs, the 2nd paragraph that reads:

"  Upon receipt of the SIP INVITE method, the Serving SIP Proxy in the
   home network MAY send an authorization request to the AAAH, in order
   to determine whether the session can be established. The
   authorization check by the AAAH MAY include other policy decisions,
   such as time of day, origination point of the session, etc. A
   successful response from the AAAH will result in the forwarding of
   the SIP INVITE method to the SIP Client. A response that includes an
   error would cause the Serving SIP Proxy in the home network to return
   an error back to the initiating SIP Client."

should read:

"Upon receipt of the SIP INVITE method, the Serving SIP Proxy in the
home network MAY send an authorization and/or authentication request to the AAAH, in order
to determine whether the session can be established. The
authorization/authentication check by the AAAH MAY include other policy decisions,
such as time of day, origination point of the session, etc. A challenge-response procedure MAY be initiated by the SSP, in order to authenticate the originating client. After the authentication/authentication processes have been performed, a
successful response from the AAAH will result in the forwarding of 
the SIP INVITE method to the SIP Client. A response that includes an
error would cause the Serving SIP Proxy in the home network to return
an error back to the initiating SIP Client."

I hope it helps.

BR,
Carolina

>Some of you pointed out that some of the drafts in the reading 
>list on the
>agenda where obsolete.  I've updated the following drafts on the
>supplemental web site:
>
>draft-calhoun-sip-aaa-reqs-04.txt
>draft-schulzrinne-sipping-sos-01.txt
>draft-rosenberg-sip-call-package-01.txt
>
>These are now referenced in the agenda at:
>
>http://www.softarmor.com/sipping/meets/ietf53/agenda.html
>
>
>Please let me know if there are any other errors.
>
>thanks,
>-rohan
>
>
>
>_______________________________________________
>Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
>This list is for NEW development of the application of SIP
>Use [email-masked] for questions on current sip
>Use [email-masked] for new developments of core SIP
>

_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [email-masked] for questions on current sip
Use [email-masked] for new developments of core SIP