Re: [sipcore] I-D Action: draft-ietf-sipcore-sip-token-authnz-02.txt

[Roman Shpount <[e-mail]>]

On Wed, Jul 10, 2019 at 2:40 AM Olle E. Johansson <[e-mail]> wrote:

> On 10 Jul 2019, at 03:44, Roman Shpount <[e-mail]> wrote:
>
> On Tue, Jul 9, 2019 at 9:29 PM Rifaat Shekh-Yusef <[e-mail]>
> wrote:
>
>> For me, the main motivation is SSO.
>> The user would use one set of corporate credentials to authenticate,
>> login to a deskphone, and get access to SIP and non-SIP services.
>>
>> I am not sure I am following your use case.
>> How would the user authenticate and obtain a an access token in this case?
>>
>>
> The use case is the same SSO in combination with hot desks and multiple
> PBXs. User picks a desk at a remote office, goes to a web page to login,
> enters his credentials and desk location. Expected result is that the phone
> on this temporary desk will ring when user gets a call on user's extension
> on the user home PBX. Internally, SSO system produces a token, which is
> sent to the PBX in the remote office. PBX in the remote office registers
> using this token with use home PBX, and configures that all the calls for
> this registration are forwarded to the phone on the user temporary desk.
> All the calls placed from that desk are also placed through user home PBX
> so that correct line is used and user home caller ID is displayed.
>
>
> That seems very complex. How is the token transferred from the web browser
> to the phone? And how does the home PBX validate the token sent on behalf
> of the user by the remove office PBX?
>
> Many chains of trust or many leaps of faith.
>
> But interesting.
>
>
One way to do it is, that remote PBX sends a registration to the home PBX
with the token and adds a forwarding rule to the device on the desk. End
device credentials are only used between end device and remote PBX, so
nothing on the device changes.

Another way to do it, if caller ID does not need to be preserved on user
calls, is to run a separate service which performs the third party
registration on user home PBX. As a result of user login via a web form,
this service initiates the registration to the user home PBX with token
authentication. Contact address in this registration is the URL pointed to
the remote office PBX, which is pre-configured to ring the phone on user
desk. I think I've built a couple of services like this, but needed to
store user credentials in DB, which was not secure. Using OAuth would have
been much cleaner.

Best Regards.
_____________
Roman Shpount