Subject: [Geopriv] Residual comment on common policy authentication

From: "Richard L. Barnes" <[email-masked]>
Date: Tue, 11 Jul 2006 17:02:42 -0400

Hey guys,

A while back, during the WGLC on the common policy draft, I had made a 
comment that I don't think ever got implemented:  In section 7.1.1, the 
document says that "acceptable means of authentication are defined in 
protocol-specific documents".  To fulfill this requirement, the SIMPLE 
presence rules (draft-ietf-simple-presence-rules) define a set of forms 
of authentication that an implementation must accept; in section 
3.1.1.1, "a request is considered authenticated if any of the following 
techniques is used...".

This struck me as odd, since the decision of which forms of 
authentication are acceptable is more commonly the choice of not just 
not just a specific implementation, but a specific deployment of that 
implementation.  Under the current policy, a corporate presence server 
that only considers authenticated identities that hold a certificate 
from the corporate PKI would be noncompliant. If, for the sake of 
argument, the presence server were part of a SIP proxy that used digest 
authentication for other functions, it would have to accept requests 
authenticated with this method for presence purposes as well.

Is it too late to suggest the following change?

OLD:
Only authenticated entities can be matched; acceptable means of 
authentication are defined in protocol-specific documents.

NEW:
Only authenticated entities can be matched: Protocol-specific documents
MUST specify at least one form of authentication that implementations
must accept, and MAY also specify additional forms of authentication
that implementations may or may not accept.

Cheers,
--Richard

_______________________________________________
Geopriv mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/geopriv