Re: [rtcweb] Fwd: New Version Notification for draft-uberti-rtcweb-turn-rest-00.txt

["Muthu Arul Mozhi Perumal (mperumal)" <[e-mail]>]

Hi Justin,

A few quick comments:
1) The primary advantage of the proposed mechanism seems not requiring any interaction between the web service and the TURN service in order for the TURN service to grant TURN credentials in the HTTP response -- this absence of interaction isn't evident on a first read. A diagram showing the client, web service, TURN service and the messages exchanged would be helpful.

2)
|If desired, the TURN server can optionally verify that the parsed
|user id value corresponds to a currently valid user of an external
|service (e.g. is currently logged in to the web app that is making
|use of TURN).  This requires proprietary communication between the
|TURN server and external service on each ALLOCATE request, so this
|usage is not recommended for typical applications.  If this external
|verification fails, it SHOULD reject the request with a 401
|(Unauthorized) error.

Was the intention of putting "not recommended" having a normative statement? If not, it would be better to change it to "no needed".

3) There is no text describing how the timestamp encoded in the UNSERNAME attribute of the ALLOCAE requested could be protected.

4) draft-reddy-behave-turn-auth describes the issues with TURN authentication and draft-uberti-rtcweb-turn-rest looks like one possible solution. Looks both could reference each other.

Muthu

From: [e-mail] [mailto:[e-mail]] On Behalf Of Justin Uberti
Sent: Monday, July 08, 2013 9:55 AM
To: [e-mail]
Subject: [rtcweb] Fwd: New Version Notification for draft-uberti-rtcweb-turn-rest-00.txt

Just uploaded a 00 version of a spec for requesting time-limited TURN credentials for WebRTC apps. Would like to get 10 minutes of agenda time to present this in Berlin.

---------- Forwarded message ----------
From: <[e-mail]<mailto:[e-mail]>>
Date: Mon, Jul 8, 2013 at 12:15 AM
Subject: New Version Notification for draft-uberti-rtcweb-turn-rest-00.txt
To: Justin Uberti <[e-mail]<mailto:[e-mail]>>



A new version of I-D, draft-uberti-rtcweb-turn-rest-00.txt
has been successfully submitted by Justin Uberti and posted to the
IETF repository.

Filename:        draft-uberti-rtcweb-turn-rest
Revision:        00
Title:           A REST API For Access To TURN Services
Creation date:   2013-07-08
Group:           Individual Submission
Number of pages: 7
URL:             http://www.ietf.org/internet-drafts/draft-uberti-rtcweb-turn-rest-00.txt
Status:          http://datatracker.ietf.org/doc/draft-uberti-rtcweb-turn-rest
Htmlized:        http://tools.ietf.org/html/draft-uberti-rtcweb-turn-rest-00


Abstract:
   This document describes a proposed standard REST API for obtaining
   access to TURN services via ephemeral (i.e. time-limited)
   credentials.  These credentials are vended by a web service over
   HTTP, and then supplied to and checked by a TURN server using the
   standard TURN protocol.  The usage of ephemeral credentials ensures
   that access to the TURN server can be controlled even if the
   credentials can be discovered by the user, as is the case in WebRTC
   where TURN credentials must be specified in Javascript.




The IETF Secretariat