Subject: [MEDIACTRL] Comments draft-boulton-conference-control-package

From: "Even, Roni" <[email-masked]>
Date: Wed, 2 Apr 2008 18:32:43 +0300

Hi,

While reviewing the draft I have some comments.

1.	I suggest adding a request to query running conferences. This will enable an AS to pickup on-going conferences if the AS re-booted.
2.	The current specification is missing a request that will enable an AS to subscribe/control on-going conference. This is tied to the first comment enabling an AS to resume the control of on-going conferences .

Thanks

Roni Even

_______________________________________________
MEDIACTRL mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mediactrl
Supplemental Web Site:
http://www.standardstrack.com/ietf/mediactrl

---

From: "McGlashan, Scott" <[email-masked]>
Date: Wed, 2 Apr 2008 16:10:25 +0000

Hi Roni,

    [scott] Agreed. AS would get a list of conferenceids. I'll add to the next revision.

 1.  The current specification is missing a request that will enable an AS to subscribe/control on-going conference. This is tied to the first comment enabling an AS to resume the control of on-going conferences .

    [scott] Right, I'll add this to. The specs haven't covered what happens when a control channels on which a conference was created, and upon which conference events are delivered, dies, a new AS establishes a new control channel, audits the conference instances and wants to take over the conference. We need to look at whether this can be done with <modifyconference>, or a new command  as you suggest. Are there any security/authorization issues we need to address? How do we prevent an evil AS taking over another AS's conference?

  Thanks
Roni Even

---

From: Diego Besprosvan <[email-masked]>
Date: Thu, 3 Apr 2008 09:30:18 +0300

Hi;
I think the mechanism has to be generalized and not only for  
conferences.
I remember adding some requirement to the requirements document for  
exactly those situations when an AS has to
query a media server for existing channels/sessions belonging to  
another AS ( or opened by another AS).

This is also true for IVRs, when an AS wants to take over a failed one  
and continue with an existing ivr session/dialog.

Regards
-------
Diego Besprosvan (:--:)
MailVision Ltd.
[email-masked]

On Apr 2, 2008, at 7:10 PM, McGlashan, Scott wrote:

> I suggest adding a request to query running conferences. This will  
> enable an AS to pickup on-going conferences if the AS re-booted.
> The current specification is missing a request that will enable an  
> AS to subscribe/control on-going conference. This is tied to the  
> first comment enabling an AS to resume the control of on-going  
> conferences .
>     [scott] Right, I'll add this to. The specs haven't covered what  
> happens when a control channels on which a conference was created,  
> and upon which conference events are delivered, dies, a new AS  
> establishes a new control channel, audits the conference instances  
> and wants to take over the conference. We need to look at whether  
> this can be done with <modifyconference>, or a new command  as you  
> suggest. Are there any security/authorization issues we need to  
> address? How do we prevent an evil AS taking over another AS's  
> conference?
>
>   Thanks
> Roni Even

---

From: "McGlashan, Scott" <[email-masked]>
Date: Thu, 3 Apr 2008 10:20:03 +0000

Hi Diego,

Fully agree. The next ivr package draft will include this audit functionality too (since the framework will mandate it).

Again, we need to address the security issue - how to stop an evil AS taking over the dialog or conference?

My current thinking is that when the MS creates a dialog or conference resource, it returns an authorization key in the response. The key must be present in requests for manipulating a resource when the request originates on an control channel other than the one used to create the resource.

This assumes that when an AS creates a dialog or conference it stores the returned key in such a way that it can be recovered and used by the other AS taking over the session. If the AS doesn't have this key, it cannot manipulate resources created on another control channel.

Does this sound reasonable? Edge cases to consider?

Scott

________________________________
From: Diego Besprosvan [mailto:[email-masked]]
Sent: Thursday, April 03, 2008 08:30
To: McGlashan, Scott
Cc: Even, Roni; [email-masked]
Subject: Re: [MEDIACTRL] Comments draft-boulton-conference-control-package

Hi;
I think the mechanism has to be generalized and not only for conferences.
I remember adding some requirement to the requirements document for exactly those situations when an AS has to
query a media server for existing channels/sessions belonging to another AS ( or opened by another AS).

This is also true for IVRs, when an AS wants to take over a failed one and continue with an existing ivr session/dialog.

Regards
-------
Diego Besprosvan (:--:)
MailVision Ltd.
[email-masked]<mailto:[email-masked]>

  Thanks
Roni Even
_______________________________________________
MEDIACTRL mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/mediactrl
Supplemental Web Site:
http://www.standardstrack.com/ietf/mediactrl

---

From: "Even, Roni" <[email-masked]>
Date: Thu, 3 Apr 2008 13:26:37 +0300

Scott,

This is one option. Another way is to specify that an authorization
mechanism is required; it can be using a token as you suggested or based
on policy that relates to authenticated identity.

Roni

From: McGlashan, Scott [mailto:[email-masked]] 
Sent: Thursday, April 03, 2008 1:20 PM
To: Diego Besprosvan
Cc: Even, Roni; [email-masked]
Subject: RE: [MEDIACTRL] Comments
draft-boulton-conference-control-package

Hi Diego,

Fully agree. The next ivr package draft will include this audit
functionality too (since the framework will mandate it).

Again, we need to address the security issue - how to stop an evil AS
taking over the dialog or conference? 

My current thinking is that when the MS creates a dialog or conference
resource, it returns an authorization key in the response. The key must
be present in requests for manipulating a resource when the request
originates on an control channel other than the one used to create the
resource. 

This assumes that when an AS creates a dialog or conference it stores
the returned key in such a way that it can be recovered and used by the
other AS taking over the session. If the AS doesn't have this key, it
cannot manipulate resources created on another control channel. 

Scott 

From: Diego Besprosvan [mailto:[email-masked]] 
Sent: Thursday, April 03, 2008 08:30
To: McGlashan, Scott
Cc: Even, Roni; [email-masked]
Subject: Re: [MEDIACTRL] Comments
draft-boulton-conference-control-package

Hi; 

query a media server for existing channels/sessions belonging to another
AS ( or opened by another AS).

Regards
-------

Diego Besprosvan (:--:)

MailVision Ltd.

[email-masked]

Hi Roni,

1.	I suggest adding a request to query running conferences. This
will enable an AS to pickup on-going conferences if the AS re-booted.  

    [scott] Agreed. AS would get a list of conferenceids. I'll add to
the next revision.   

1.	The current specification is missing a request that will enable
an AS to subscribe/control on-going conference. This is tied to the
first comment enabling an AS to resume the control of on-going
conferences .  

    [scott] Right, I'll add this to. The specs haven't covered what
happens when a control channels on which a conference was created, and
upon which conference events are delivered, dies, a new AS establishes a
new control channel, audits the conference instances and wants to take
over the conference. We need to look at whether this can be done with
<modifyconference>, or a new command  as you suggest. Are there any
security/authorization issues we need to address? How do we prevent an
evil AS taking over another AS's conference? 

  Thanks

Roni Even

---

From: "McGlashan, Scott" <[email-masked]>
Date: Thu, 3 Apr 2008 10:34:31 +0000

Right. As I posted the message, I realized that we could address this through the Framework Section 11.3 Control Channel Policy Management. A token based mechanism is one possible implementation. It may be a good example for XML extensiblity sections in the specs: i.e. if you want to do authentication based on tokens in the XML, then there is an example of how you use a token attribute in a non-mediactrl namespace.

thanks

Scott

________________________________
From: Even, Roni [mailto:[email-masked]]
Sent: Thursday, April 03, 2008 12:27
To: McGlashan, Scott; Diego Besprosvan
Cc: [email-masked]
Subject: RE: [MEDIACTRL] Comments draft-boulton-conference-control-package

Scott,
This is one option. Another way is to specify that an authorization mechanism is required; it can be using a token as you suggested or based on policy that relates to authenticated identity.
Roni

Subject: RE: [MEDIACTRL] Comments draft-boulton-conference-control-package

Hi Diego,

Scott

Regards
-------
Diego Besprosvan (:--:)
MailVision Ltd.

Hi Roni,

  Thanks
Roni Even