Subject: RE: [Sipping] Comments on config framework draft - AOR

From: [email-masked]
Date: Thu, 30 Sep 2004 14:26:30 +0300

Yes, I had the authentication mechanism in mind. I don't think anything should be done without some form of authentication and therefore "network-user" to me is useless. Are there any cases where we can leave authentication out?

Regards,
Hisham

> -----Original Message-----
> From: ext Volker Hilt [mailto:[email-masked]]
> Sent: 29.September.2004 19:28
> To: Khartabil Hisham (Nokia-TP-MSW/Helsinki)
> Cc: [email-masked]; [email-masked]
> Subject: Re: [Sipping] Comments on config framework draft - AOR
> 
> 
> [email-masked] wrote:
> > - "The "network-user" parameter is used when subscribing for local
> >    network profiles.  If the value of the profile-name 
> parameter is not
> >    "local", the "network-user" parameter has no defined 
> meaning.  If the
> >    user has special privileges beyond that of an anonymous 
> user in the
> >    local network, the "network-user" parameter identifies 
> the user to
> >    the local network.  The value of this parameter is the 
> user's address
> >    of record.  The SUBSCRIBE server may authenticate the 
> subscriber to
> >    verify this AOR."
> > 
> > I don't believe this is needed. Authentication should be 
> out of scope
> > of this document. Also, the identity (AOR) of the user 
> should be derived
>  > after authentication locally, no need for the network-user param.
> >
> The URI of the SUBSCRIBE request for "local" profiles will 
> point to the 
> local network domain (e.g. [email-masked]) and it 
> will therefore 
> not contain the AoR of the user. Without the network-user 
> parameter, the 
> local network would not know the AoR of the subscribing user 
> unless, of 
> course, it derive the AoR through an authentication 
> mechanism. With the 
> "network-user" parameter the local profile type works with 
> *and* without 
> authentication.
> 
> > 
> > Section 3.7
> > ------------
> > 
> > - "A user agent can provide hotelling by collecting a userËs AOR and
> >    credentials needed to SUBSCRIBE and retrieve the user's profiles.
> >    hotelling functionality is achieved by subscribing to 
> the user's AOR
> >    and specifying the "user" profile type.  This same 
> mechanism can also
> >    be used to secure a user agent, requiring a user to 
> login to enable
> >    functionality beyond the default userËs restricted 
> functionality."
> > 
> > Again, the user's AOR should not be explicitly required by the 
> > server. After authentication, the server should be able to 
> deduce the
> > user's AoR from some DB.
> > 
> Yes, authentication could provide the server with this 
> information. But 
> this would make authentication mandatory if the server wants 
> to know the 
> AoR. Not sure if we want to go down this path.
> 
> Thanks,
> 
> Volker
> 
> 
> 

_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [email-masked] for questions on current sip
Use [email-masked] for new developments of core SIP

---

From: Volker Hilt <[email-masked]>
Date: Thu, 30 Sep 2004 12:36:42 -0400

Hisham,

I agree that authenticating the user is generally a good idea. A case 
where it might be ok to leave the authentication out for the 
subscription to profile data is if content indirection is used to 
deliver the profiles. In this case, it might make sense to authenticate 
the profile download but not the subscription.

Thanks,

Volker

[email-masked] wrote:
> Yes, I had the authentication mechanism in mind. I don't think
> anything should be done without some form of authentication and
> therefore "network-user" to me is useless. Are there any cases where
> we can leave authentication out?
> 
> Regards, Hisham
> 
> 
>> -----Original Message----- From: ext Volker Hilt
>> [mailto:[email-masked]] Sent: 29.September.2004 19:28 To:
>> Khartabil Hisham (Nokia-TP-MSW/Helsinki) Cc: [email-masked];
>> [email-masked] Subject: Re: [Sipping] Comments on config
>> framework draft - AOR
>> 
>> 
>>> - "The "network-user" parameter is used when subscribing for
>>> local network profiles.  If the value of the profile-name
>> 
>> parameter is not
>> 
>> The URI of the SUBSCRIBE request for "local" profiles will point to
>> the local network domain (e.g. [email-masked]) and it will
>> therefore not contain the AoR of the user. Without the network-user
>>  parameter, the local network would not know the AoR of the
>> subscribing user unless, of course, it derive the AoR through an
>> authentication mechanism. With the "network-user" parameter the
>> local profile type works with *and* without authentication.
>> 
>> 
>>> Section 3.7 ------------
>>> 
>>> - "A user agent can provide hotelling by collecting a userËs AOR
>>> and credentials needed to SUBSCRIBE and retrieve the user's
>>> profiles. hotelling functionality is achieved by subscribing to
>> 
>> the user's AOR
>> 
>> Yes, authentication could provide the server with this information.
>> But this would make authentication mandatory if the server wants to
>> know the AoR. Not sure if we want to go down this path.
>> 
>> Thanks,
>> 
>> Volker
>> 
>> 
>> 
> 
> 

-- 
Volker Hilt                      Bell Labs / Lucent Technologies
phone: +1 732 332 6432           101 Crawfords Corner Rd
email: [email-masked]     Holmdel, NJ 07733