Re: [Sip] Event Lists: Back-End Credentials

David R Oran wrote:

> Sigh. Delegation is hard. I frankly don't like any of these solutions 
> because they allow full user impersonation by the RLS, which is a lot 
> more trust that I think ought to be given it.

I'm not too crazy about them either (I'll note that suggestion #2 
doesn't have that property, but at the cost of making the protocol far 
less useful).

>
> If we want to really tackle delegation, I'd suggest that we extend SIP 
> generally to allow SIP-specific delegation capability. One way to do 
> this is for the user to construct a certificate for the RLS giving it 
> specific rights (e.g. Subscribe on my behalf), and then signing it 
> based on a credential that would be accepted by the ultimate target of 
> the request. SAML might be our friend here.

That feels a lot like what I was trying to get at with my suggestion #4, 
albeit with a slightly different mechanism. The problem is that pursuing 
this kind of work will be very time consuming... and the event list 
document has been in limbo for over a year already. I'm not necessarily 
advocating expediency over security -- it's been so long since I started 
this work that I'm half inclined to cripple it (by removing back-end 
subscriptions) rather than wait several years for a general purpose 
solution to the delegation problem. Not that I *want* to do this -- it 
would remove most of the utility of the extension for the 3G guys -- but 
I do want to put this work to bed.

I'm not sure if it represents a reasonable compromise, but I'm not 
averse to putting in the "use this header to transfer your secret" with 
a strongly worded note indicating the implications if you do, and an 
indication that future mechanisms may define more constrained ways to 
delegate limited subsets of authority to another node (possibly for a 
constrained time period).

/a

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use sip-implementors@cs.columbia.edu for questions on current sip
Use sipping@ietf.org for new developments on the application of sip