Re: : ISSUE, SIP, authentication parameters

Hi:

First I am sorry to say that the time for the 3rd WGLC is over, so we 
are not ready to make changes during this process. We can do changes 
during the IETF Last call, if those changes are justified.

With respect your comment. We discussed this issue about 2 years ago, 
and we wanted to add a possibility to enable the scenario described in 
Sections 5.5 and 5.6, where an outbound proxy is authorizing request. 
Some users might be authorized to use any SIP method, others only a few 
of them. In order to do this, the SIP-Method must be present. And at 
that point in time, the user might not have sent any Authorization 
header, so the Digest-Method might not be present.

Sorry, but NO.

/Miguel

[email protected] wrote:

> Description of issue: Authentication parameters
> Submitter name: Mikko Aittola
> Submitter email address: [email protected]
> Date first submitted: 25 Oct 05
> Document: sip (v. 10)
> Comment type: T
> Priority: S
> Sections: 7.7, 7.8, 8.5.3, 8.5.4, 8.5.5
> Rationale/Explanation of issue:
> 
> SIP-Method is defined to be required AVP in MAR-command.
> Is there really need for this to be required AVP?
> I think Diameter server doesn't necessarily need to consider
> what is the SIP-method the SIP-server is asking to authenticate.
> 
> Furthermore, there is already optional Digest-Method AVP
> in SIP-Authorization grouped AVP. This can be used for
> the same purpose as SIP-Method AVP.
> 
> SIP-Authorization grouped AVP contains required AVP
> Digest-Username. This is duplicate information with
> the User-Name AVP sent in the MAR-command.
> 
> It seems the case where Diameter server sends HA1 in MAA
> and client calculates and checks the response has not been
> taken into account when the required contents of SIP-Authorization,
> SIP-Authenticate, and SIP-Authentication-Info AVP have been defined.
> 
> It is not clear what is included to MAA message in case
> Diameter server has checked the response successfully.
> It might be useful if the Diameter client receives a confirmation
> of the auth-scheme applied by the Diameter-server.
> 
> 
> Requested changes:
> 
> 1. Remove SIP-Method AVP from the spec
> 2. Remove Digest-Username from the spec. (If needed add text where
>    it is explained that Digest-Username is translated to
>    User-Name in the case of Radius-Diameter translation.)
> 3. Change Digest-Nonce to optional in SIP-Authenticate
> 4. Change the following AVPs to optional in SIP-Authorization AVP:
>    Digest-Nonce, Digest-URI, Digest-Response
> 5. Change Digest-Nextnonce to optional in SIP-Authentication-Info AVP
> 6. After Diameter server has checked that the response is ok
>    it returns MAA where result-code is SUCCESS, and SIP-Auth-Data-Item
>    with the SIP-Authentication-Scheme AVP.
> 
> 7. Change the following text in Section 7.8:
>    If the SIP-Methods AVP value of the Diameter MAR message is set to
>    REGISTER and a User-Name AVP is present, then the Diameter server
>    MUST authorize that User-Name AVP value is able to use the URI
>    included in the SIP-AOR AVP.  If this authorization fails, the
>    Diameter server must set the Result-Code AVP to
>    DIAMETER_ERROR_IDENTITIES_DONT_MATCH and send it in a Diameter
>    Multimedia-Auth-Answer (MAA) message.
>  To:
>    If the Digest-Method AVP value is either absent or received with a
>    value REGISTER in the Diameter MAR message and a User-Name AVP is
>    present, then the Diameter server MUST authorize that User-Name AVP
>    value is able to use the URI included in the SIP-AOR AVP.  If this
>    authorization fails, the Diameter server must set the Result-Code AVP to
>    DIAMETER_ERROR_IDENTITIES_DONT_MATCH and send it in a Diameter
>    Multimedia-Auth-Answer (MAA) message.
> 
> 
> BR,
> Mikko
> 
> 
> PS. Sorry for the late submission..
> 

-- 
Miguel A. Garcia           tel:+358-50-4804586
sip:[email protected]
Nokia Research Center      Helsinki, Finland