Subject: [tram] I-D Action: draft-ietf-tram-turn-third-party-authz-06.txt

From: [email-masked]
Date: Tue, 20 Jan 2015 07:51:50 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the TURN Revised and Modernized Working Group of the IETF.

        Title           : Session Traversal Utilities for NAT (STUN) Extension for Third Party Authorization
        Authors         : Tirumaleswar Reddy
                          Prashanth Patil
                          Ram Mohan Ravindranath
                          Justin Uberti
	Filename        : draft-ietf-tram-turn-third-party-authz-06.txt
	Pages           : 20
	Date            : 2015-01-20

Abstract:
   This document proposes the use of OAuth to obtain and validate
   ephemeral tokens that can be used for Session Traversal Utilities for
   NAT (STUN) authentication.  The usage of ephemeral tokens ensure that
   access to a STUN server can be controlled even if the tokens are
   compromised.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-tram-turn-third-party-authz/

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-tram-turn-third-party-authz-06

A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=draft-ietf-tram-turn-third-party-authz-06

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: "Tirumaleswar Reddy (tireddy)" <[email-masked]>
Date: Tue, 20 Jan 2015 15:55:17 +0000

Revision http://tools.ietf.org/html/draft-ietf-tram-turn-third-party-authz-06 addresses comments from Spencer.

-Tiru

> -----Original Message-----
> From: tram [mailto:[email-masked]] On Behalf Of internet-
> [email-masked]
> Sent: Tuesday, January 20, 2015 9:22 PM
> To: [email-masked]
> Cc: [email-masked]
> Subject: [tram] I-D Action: draft-ietf-tram-turn-third-party-authz-06.txt
> 
> 
> _______________________________________________
> tram mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tram

---

From: Oleg Moskalenko <[email-masked]>
Date: Tue, 20 Jan 2015 11:33:25 -0800

A new change that I noticed in this draft is that it is making impossible
simultaneous support of the original 'legacy' long-term credentials and the
new third party credentials in the same server. If the server includes the
THIRD-PARTY-AUTHORIZATION attribute in the 401 response, then the client is
REQUIRED to provide the new authorization scheme. So, we have a few
problems here:

1) This is incompatible with the old clients.
2) If we really do want that change, then we have to make the
THIRD-PARTY-AUTHORIZATION attribute comprehension-required. Currently, it
is comprehension-optional. With the current scheme, there is a logical
mistake: you are allowing the client to ignore the TPA attribute (by making
it comprehension-optional) but in the same time you are NOT allowing the
client to ignore it (because you are requiring that the third-party
authorization to be used). It has to be resolved one way or another.

I'd recommend to rollback to the previous draft because the older draft did
not have contradictions and the old draft allowed the server administrators
to decide which combination of the authorization schemes they want to
deploy.

On Tue, Jan 20, 2015 at 7:55 AM, Tirumaleswar Reddy (tireddy) <
[email-masked]> wrote:

> Revision
> addresses comments from Spencer.
>
> -Tiru
>
> >         Title           : Session Traversal Utilities for NAT (STUN)
> Extension for Third
> > Party Authorization