Subject: RE: [Sip] Re: [Sipping] New version of the SIP-AAA reqs draft

From: [email-masked]
Date: Mon, 3 Mar 2003 15:23:22 +0200

Hi,

Inline.

 > -----Original Message-----
 > From: ext [email-masked] [mailto:[email-masked]]
 > Sent: 28 February, 2003 13:44
 > To: Gonzalo Camarillo
 > Cc: Beck01, Wolfgang; [email-masked]; [email-masked];
 > [email-masked]; Jari Arkko
 > Subject: Re: [Sip] Re: [Sipping] New version of the SIP-AAA 
 > reqs draft
 > 
 > 
 > Gonzalo Camarillo writes:
 > 
 >  > Here you have a figure of the scenario you have just described:
 >  > 
 >  >                        alice.com   . . .   bob.com
 >  >                  .       proxy              proxy     .
 >  >                .                                       .
 >  >          Alice  . . . . . . . . . . . . . . . . . . . .  Bob
 >  >       
 >  > We have an INVITE from [email-masked] to [email-masked]
 > 
 > no, originally, we have an invite from [email-masked] to
 > [email-masked] that gets translated by enum to [email-masked].

Ok, so the only proxy in this case that can authenticate this INVITE is alice.com. If you don't have inter-domain AAA, that's the only proxy that alice has credentials with. Unless of course anonymous authentication is an option?

 >  > 
 >  > Now, you have a BYE from Bob to Alice. In your scenario, 
 > which proxy is
 >  > doing accounting, alice.com or bob.com?
 > 
 > both proxies account both placed and received calls of their 
 > own users.

I don't know why bob.com would want to authenticate bob's BYE, when it didn't have the tools to authenticate the original INVITE from alice? In other words, why would you accept accounting the unauthenticated INVITE, but not the BYE?

Cheers,
Aki

 > -- juha
 > 
 > _______________________________________________
 > Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
 > This list is for NEW development of the application of SIP
 > Use [email-masked] for questions on current sip
 > Use [email-masked] for new developments of core SIP
 > 
_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [email-masked] for questions on current sip
Use [email-masked] for new developments of core SIP

---

From: [email-masked]
Date: Mon, 3 Mar 2003 17:02:47 +0200

[email-masked] writes:

 > Ok, so the only proxy in this case that can authenticate this INVITE
 > is alice.com. If you don't have inter-domain AAA, that's the only
 > proxy that alice has credentials with. Unless of course anonymous
 > authentication is an option? 

yes, the idea should be that each proxy authenticates requests that are
send by useres directly connected to them.  proxies then can trust each
other as you suggest.

the problem is that the proxy of the user sending bye, can't
authenticate the user sending it, because there is no way for the proxy
to figure out the realm of that user.  this is a big shortcoming in
current sip.

-- juha