Subject: [Sipping] Consent open issue: mechanisms to upload permissions

From: Gonzalo Camarillo <[email-masked]>
Date: Sun, 13 Feb 2005 10:25:15 +0200

Folks,

in the last IETF we had some discussions on the mechanism to upload 
permission documents to a relay. We would like to get more feedback from 
the list. The relevant documents are:

http://www.ietf.org/internet-drafts/draft-ietf-sipping-consent-reqs-00.txt
http://www.ietf.org/internet-drafts/draft-ietf-sipping-consent-framework-00.txt

This is the flow we are looking at (simplified version of the flow in 
Section 13.1 of the framework):

              A                  Relay + XCAP Server                  B
              |(3) CONSENT xyz@relay      |                           |
              |-------------------------->|                           |
              |                           |(4) CONSENT B              |
              |                           |Permission-Requested: uri-req
              |                           |-------------------------->|
              |                           |(5) 202 Accepted           |
              |                           |<--------------------------|
              |(6) 202 Accepted           |                           |
              |<--------------------------|                           |
              |                           |(11) XCAP uri-req          |
              |                           |Get Requested Permission   |
              |                           |<--------------------------|
              |                           |(12) 200 OK                |
              |                           |Permission Document        |
              |                           |URI to Upload: uri-up      |
              |                           |-------------------------->|
              |                           |(13) XCAP uri-up           |
              |                           |Permission Document        |
              |                           |<--------------------------|
              |                           |(14) 200 OK                |
              |                           |-------------------------->|

The steps are:

1) The Relay adds a URI to the CONSENT request.
2) User agent B uses the URI obtained in step 1 to obtain the
    permissions being requested and the URI where the permissions should
    be uploaded.
3) User agent B uploads the permissions using the URI obtained in
    step 2.

At this point, XCAP is used in both step 2 and 3. The proposals in 
Washington consisted of using SIP (e.g., PUBLISH) in step 3. This way, 
user agents would not need to support XCAP, and the authentication of 
the upload of the permission document could be done using SIP identity.

Note that if we use SIP identify we will need to get rid of the 
following requirement:

    REQ 9: The solution shall work in an inter-domain context, without
       requiring pre-established relationships between domains.

Additionally, step 2 could be based on vanilla HTTP (no XCAP). Note that 
this step is a simple content indirection that is needed because the 
relay acts as a proxy and, consequently, cannot add a body to the 
CONSENT with the requested permissions. The question here is whether it 
is OK to use a token-based authentication approach (the HTTP URI is long 
and random and the CONSENT is protected using SIPS) or we can use 
something else.

Comments are welcome,

Thanks,

Gonzalo

_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [email-masked] for questions on current sip
Use [email-masked] for new developments of core SIP