Re: [sipcore] I-D Action: draft-ietf-sipcore-sip-token-authnz-04.txt

[Paul Kyzivat <[e-mail]>]

Rifaat,

On 10/19/19 4:23 PM, Rifaat Shekh-Yusef wrote:
> All,
> 
> We update the draft based on the latest comments, mainly from Paul.
> Please, take a look and let us know what you think.

Thanks. This is better. I have some followup questions to broaden my 
understanding. (Once I understand better, I may have some suggestions on 
how to make the document clearer in this regard.)

IIUC, upon getting a challenge for which there is no cached response, 
the typical expected behavior for a UA is to launch a browser using the 
URL from the authz-server-value in the challenge. Is that right?

I'm not clear on the sequence of events following that. IOW, I'm looking 
for more detail on step [3] in the figure in section 5.1. I would expect 
that this first action of the browser will result in the AS returning a 
form to the browser that will be displayed to the user. Then the user 
will presumably need to fill in that form and send it to the AS. And 
this may involve a dialog of multiple exchanges. This will presumably 
eventually end with a response from the AS containing a token. How does 
the UA recognize this as the completion of the dialog?

In particular, does the UA need to know anything about the AS or the 
authentication environment in which it is operating? Or is this 
consistent across all types of AS?

Also, I gather there can be different kinds of token in the response. Is 
this of concern to the UA? Or does the UA blindly pass the resulting 
token on to the registrar, so that the registrar can decide what to do 
with it?

Another point I want to follow up on is: you have now clarified that the 
authz-server-value contains a URL referencing the AS. Why not tighten 
the syntax to specify the allowed value types? I presume you intend this 
to be something that a browser can use to query the AS. The obvious type 
for this is an HTTPS URL. I am guessing that you are leaving this vague 
to allow other types that might be supported by browsers and ASs. But 
presumably there is something you can say about the properties expected 
of this URL. I guess it ought to be something that is generally 
supported by browsers, and that can be used to reference forms. (E.g., a 
SIP URL wouldn't be appropriate here.)

	Thanks,
	Paul

> 
> Regards,
>   Rifaat
> 
> 
> On Sat, Oct 19, 2019 at 4:21 PM <[e-mail] 
> <mailto:[e-mail]>> wrote:
> 
> 
>     A New Internet-Draft is available from the on-line Internet-Drafts
>     directories.
>     This draft is a work item of the Session Initiation Protocol Core WG
>     of the IETF.
> 
>              Title           : Third-Party Token-based Authentication
>     and Authorization for Session Initiation Protocol (SIP)
>              Authors         : Rifaat Shekh-Yusef
>                                Christer Holmberg
>                                Victor Pascual
>              Filename        : draft-ietf-sipcore-sip-token-authnz-04.txt
>              Pages           : 14
>              Date            : 2019-10-19
> 
>     Abstract:
>         This document defines a mechanism for SIP, that is based on the
>     OAuth
>         2.0 and OpenID Connect Core 1.0 specifications, to enable the
>         delegation of the user authentication and SIP registration
>         authorization to a dedicated third-party entity that is separate
>     from
>         the SIP network elements that provide the SIP service.
> 
> 
>     The IETF datatracker status page for this draft is:
>     https://datatracker.ietf.org/doc/draft-ietf-sipcore-sip-token-authnz/
> 
>     There are also htmlized versions available at:
>     https://tools.ietf.org/html/draft-ietf-sipcore-sip-token-authnz-04
>     https://datatracker.ietf..org/doc/html/draft-ietf-sipcore-sip-token-authnz-04
>     <https://datatracker.ietf.org/doc/html/draft-ietf-sipcore-sip-token-authnz-04>
> 
>     A diff from the previous version is available at:
>     https://www.ietf.org/rfcdiff?url2=draft-ietf-sipcore-sip-token-authnz-04
> 
> 
>     Please note that it may take a couple of minutes from the time of
>     submission
>     until the htmlized version and diff are available at tools.ietf.org
>     <http://tools.ietf.org>.
> 
>     Internet-Drafts are also available by anonymous FTP at:
>     ftp://ftp.ietf.org/internet-drafts/
> 
>     _______________________________________________
>     sipcore mailing list
>     [e-mail] <mailto:[e-mail]>
>     https://www.ietf.org/mailman/listinfo/sipcore
> 
> 
> _______________________________________________
> sipcore mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/sipcore
>