Subject: RE: [Sip] Re: [Sipping] New version of the SIP-AAA reqs draft

From: [email-masked]
Date: Mon, 3 Mar 2003 17:22:54 +0200

I think you exaggerating here with several hundreds, but anyway, I was suggesting several hundreds of proxy-authenticate headers. Of course you can scale your network to be better than that. I'm trying to find a solution that doesn't rely on the UA to send its realm (You haven't objected to that yet).

/Hisham

> -----Original Message-----
> From: ext [email-masked] [mailto:[email-masked]]
> Sent: Monday, March 03, 2003 5:16 PM
> To: Khartabil Hisham (NMP/Helsinki)
> Cc: [email-masked]; [email-masked];
> [email-masked]; [email-masked]; [email-masked];
> [email-masked]
> Subject: RE: [Sip] Re: [Sipping] New version of the SIP-AAA reqs draft
> 
> 
> [email-masked] writes:
> 
>  > I was offering a solution to your problem in the form of a
>  > question. Here it is again in the form of a suggestion:
>  > 
>  > If your poxy supports multiple realms on the same 
> interface, then it
>  > can challenge with all the realms and therefore the UA 
> does not have
>  > to supply the realm to the proxy.
> 
> if i understod your suggestion correctly, it makes no sense. an 
> operator proxy can easily have several hundred realms 
> configured in it.
> are you suggesting sending several hundred 407s for each bye?
> 
> -- juha
> 
> 
_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [email-masked] for questions on current sip
Use [email-masked] for new developments of core SIP

---

From: [email-masked]
Date: Mon, 3 Mar 2003 17:33:40 +0200

[email-masked] writes:

  > I think you exaggerating here with several hundreds, but anyway, I
  > was suggesting several hundreds of proxy-authenticate headers. Of
  > course you can scale your network to be better than that. I'm trying
  > to find a solution that doesn't rely on the UA to send its realm
  > (You haven't objected to that yet).

the realm can be infered from the from header in invite request, but not
in bye request.  as i have explained, there is no security risk when the
user tells the realm in which it want to get authenticated.  so i don't
see any problems with that and don't understand why yiou would need to
find another for the proxy to figure it out.   this is how eap works and
that is how sip should work.

-- juha