Re: [Gen-art] Genart last call review of draft-ietf-sipcore-sip-token-authnz-12

[Christer Holmberg <[e-mail]>]

Hi Linda,

Thank You for the review! Please see inline.

>    Section 1.4.1: the first paragraph is very confusing. The steps after the
>    figure is much clear on what to be done. It is better to delete the the
>    sub-phrase "... where the registrar informs the UAC about the authorization ...
>    ". The actual step is actually the UAC sends the request to Registrar and get
>    the response .. as described in the steps after the Figure.
  
The purpose of the first sentence is to highlight the difference between 1.4.1 and 1.4.2: In 1.4.1 we describe the case where Registrars informs the UAC about the AS, while in 1.4.2 we describe the case where the AS is preconfigured in the UAC.

However, I do agree that the sentence is very long and confusing. Perhaps we could remove the "in a 401 response to the REGISTER request" part? 

---

>    Section 2.1.2 the paragraph before the last one (Page 8), I can' parse the
>    sentence. What do you want to say?

I assume you mean Section 2.1.1?

>    "If the UAC receives a 401/407 response with multiple WWWAuthenticate/
>    Proxy-Authenticate header fields, providing challenges
>    using different authentication schemes for the same realm, the UAC
>    provides credentials for one or more of the schemes that it supports,
>    based on local policy."
  
We want to say that, if the UAC receives multiple challenges, with different authentication  schemes, for the same realm, the UAC picks one (and provides credentials) based on local policy.

Would it be more clear if we said something like:

"....for the same realm, the UAC selects one or more of the provided schemes (based on local policy) and provides credentials for those schemes."

---
  
>    Section 2.1.3: What is AOR?

Address-of-Record.

We will enhance the abbreviation, and add a reference to RFC 3261.

---

Regards,

Christer