Re: [rtcweb] usability of IdP concepts in draft-ietf-rtcweb-security-arch-07

[Max Jonas Werner <[e-mail]>]

Wolfgang,

On 05.11.2013 18:06, Wolfgang Beck wrote:
> What I am missing in this draft is the link between authentication towards
> the web server and signing of DTLS info towards the remote party. To make a
> call, a user will have to
> 1) log into the web server application
> 2) permit the browser to access camera/mic
> 3) log into the IdP to sign the DTLS info
> 
> To receive a call, I will have to
> 1) log into the web server application
> 2) permit the browser to access camera/mic when there is a call
> 3) log into the IdP to sign the DTLS info
> ..and hope the caller has not given up before I clicked all permission
> boxes and entered all user credentials.
> 
> Can 1) and 3) be merged somehow? How would you explain 3) to a user?

1) and 3) can be merged if

a) the user is already logged from the IdP's point of view prior to even
visiting the site (using either built-in browser logic or manually)

or

b) the IdP is the able to identify the user from step 1) somehow (e.g.
when the web server is run by the IdP).

Keep in mind, though, that the user to be able to provide an identity to
the other WebRTC peer that is different from the identity of step 1) is
exactly what the user wants sometimes.

Max