Re: [sipcore] Draft new: draft-holmberg-sipcore-auth-id-00

[Christer Holmberg <[e-mail]>]

Hi,

>>>> The draft defines a new Authorization header field parameter, which 
>>>> can carry a string value identifying an authorization server, based 
>>>> on a requirement from 3GPP (the mechanism is general, though).
>>>
>>> The text says that the "authorization-entity" parameter carries "a 
>>> string value which represents the identity of an authorization 
>>> server".  You might want to expand on that.  I'm guessing it means 
>>> that any entity that wants to verify the authorization of the 
>>> REGISTER request should present the request contents to the 
>>> specified authorization server.
>> 
>> I am not sure I understand what you mean by "present the request 
>> contents to the specified authorization server". The identity is 
>> obtained from the authorization server (or, the eP-CSCF knows it by 
>> configuration). The identity is then provided to the S-CSCF (SIP 
>> registrar), which can use the information for policy decisions.
>
> The general idea is this:  Suppose the reader has no idea how IMS does things.  Within the SIP authorization 
> model(s) presented in the RFCs, what is the function of "authorization-entity"? 

The function is to provide the authorization server identity to the S-CSCF (registrar). The S-CSCF MAY use that information when authorizing a user. For example, it can check whether the authorization server is authorized to provide IMS credentials to the user.

3GPP does not mandate the usage of the information, and does not specify the policy procedures how it's used. 3GPP only requires the information to be conveyed to the S-CSCF.

> I assume that you intend to extend the set of SIP authorization models; it's necessary to describe, at least in outline, what the new authorization model is and how 
> "authorization-entity" is used in it so people can tell whether they want to use it in their SIP implementations and how they would do so.

The way the IMS core authorizes users as such is not changed. 

The information is there so that IMS can use the information to check whether the authorization server is used, but that authorization server may serve multiple users. 

> As this draft is currently written, it seems to be "IMS needs this, so we'll write that down and call it an RFC".  It needs considerable clarification.

As always, we need to decide whether there is any interest for this outside 3GPP. But, I am happy to provide more information/clarification.

Regards,

Christer