Subject: RE: [Sip] Re: [Sipping] New version of the SIP-AAA reqs draft

From: [email-masked]
Date: Tue, 4 Mar 2003 10:58:21 +0200

Hi Juha,

Inline.

 > -----Original Message-----
 > From: ext [email-masked] [mailto:[email-masked]]
 > Sent: 04 March, 2003 10:33
 > To: Niemi Aki (NMP/Helsinki)
 > Cc: Khartabil Hisham (NMP/Helsinki); 
 > [email-masked];
 > [email-masked]; [email-masked]; [email-masked];
 > [email-masked]; [email-masked]
 > Subject: RE: [Sip] Re: [Sipping] New version of the SIP-AAA 
 > reqs draft
 > 
 > 
 > [email-masked] writes:
 > 
 >  > Digest authenticates the username,
 >  > not the From field - these may not be exactly the same.
 > 
 > i have never claimed that digest authenticates the from field, but in
 > case of an initial request, the proxy can get the realm to be used in
 > its challenge from the from field.  in subsequent requests 
 > this is not
 > anymore possible.
 > 
 >  > This feature of blind challenges in digest has proven problematic
 >  > before, and I agree that it would be nice if there was an EAP
 >  > Identity request/response -type mechanism available in 
 > Digest. But it
 >  > isn't an easy add-on.
 > 
 > we don't need an eap style identity request/response.  what 
 > we need is
 > an ability for the ua to tell in its requests to the proxy 
 > the realm it
 > claims to belong to so that the proxy can correctly 
 > challenge it.  this
 > can be easily fixed with a single new header or parameter.

A UA can have valid credentials for hundreds of realms. Would it list all of them in this new header or param? In fact, I think what you describe above is exactly opposite to how digest works. A client never actually belongs to a single realm. By browser has stored username/passwords for about 20 different realms.

Cheers,
Aki
_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [email-masked] for questions on current sip
Use [email-masked] for new developments of core SIP

---

From: [email-masked]
Date: Tue, 4 Mar 2003 13:24:49 +0200

[email-masked] writes:

 > A UA can have valid credentials for hundreds of realms. Would it list
 > all of them in this new header or param? In fact, I think what you
 > describe above is exactly opposite to how digest works. A client
 > never actually belongs to a single realm. By browser has stored
 > username/passwords for about 20 different realms. 

i haven't seen any sip ua where i can configure more than one realm.  in
fact, i haven't sen any where i can explicitly configure any realm.
instead, some assume that the domain of the username must equal the
realm received from the proxy.

perhaps we should go back and start from the requiremnts.  i have
requirement that the proxy must be able to belong to multiple realms and
proxy aaa based on the realm.  the other requirement is that the proxy
must be able to authenticate each request that it receives from uas that
belong to the realms of the proxy .  today this is not possible in
practise.  

-- juha