Re: [sipcore] I-D Action: draft-ietf-sipcore-sip-token-authnz-02.txt

[Roman Shpount <[e-mail]>]

On Tue, Jul 9, 2019 at 3:11 PM Christer Holmberg <
[e-mail]> wrote:

> >> As far as I know, OAuth for SIP has only been used for REGISTER
> requests, between the UA and the registrar.
> >> I have never heard about anyone using it for non-REGISTER
> authentication, and I wonder whether we even need
> >> to cover it in the draft. We could limit the scope the REGISTER
> requests. Then, if anyone ever needs OAuth for non-REGISTER requests, a
> separate draft can be written.
> >
> > Really? Normally, for a secure solution, every SIP request, including
> requests sent by UA in dialog established from the
> > server to the registered end point must be authenticated. OAuth for
> REGISTRER requests only is kind of useless since it
> > does not allow UA to send any messages to the server without some
> additional authentication mechanism.
>
> Not sure what you mean by "secure solution", but UAs can still use SIP
> Digest authentication.
>
> What I am saying is that only use-case for SIP OAuth I am aware of is for
> REGISTER.
>
> How do they get these SIP Digest credentials?

I am looking at a very simple SIP-Over-Websockets client scenario:

User logs into the web site which uses OAuth. UA, running in the browser
gets a token which is used to Register UA with a SIP proxy.

What credentials is UA using to place a call (send INVITE to the proxy)?
If a call comes in from the proxy to UA, what credentials is UA using to
hang up the call (send BYE message)?

Best Regards,
_____________
Roman Shpount