Re: [sipcore] I-D Action: draft-ietf-sipcore-sip-token-authnz-02.txt

[Roman Shpount <[e-mail]>]

On Wed, Jul 10, 2019 at 2:44 AM Olle E. Johansson <[e-mail]> wrote:

>
>
> On 10 Jul 2019, at 02:53, Roman Shpount <[e-mail]> wrote:
>
> On Tue, Jul 9, 2019 at 8:30 PM Rifaat Shekh-Yusef <[e-mail]>
> wrote:
>
>> The document clearly allows the use of access token to authenticate
>> non-REGISTER requests when challenged in the context of the same realm.
>>
>> Whether that is needed or not is a different discussion.
>> Assuming the UA was able to authenticate the user and obtain an access
>> token, then establish an authenticated TLS channel with the server, and
>> register the user; is there a need for further challenges from server?
>>
>> When the token expires, you certainly need a new token from the user.
> With SIP Outbound, we’re more connection oriented than before, so we should
> propably consider what the
> server does with the connection when a token expires (if it’s not already
> in the draft).
>
>
Keep in mind that proxy responsible for SIP Outbound or Web Sockets edge
proxy and registrar can be two different servers. Connection from end user
device to SIP Outbound Proxy can be unique, but connection from edge proxy
to the registrar can be reused for multiple clients. I am sure this can be
un-bundled and made to work but it is not always trivial.

Best Regards,
_____________
Roman Shpount