Re: [sipcore] I-D Action: draft-ietf-sipcore-sip-token-authnz-02.txt

[Christer Holmberg <[e-mail]>]

Hi,

>>>> As far as I know, OAuth for SIP has only been used for REGISTER requests, between the UA and the registrar. 
>>>> I have never heard about anyone using it for non-REGISTER authentication, and I wonder whether we even need 
>>>> to cover it in the draft. We could limit the scope the REGISTER requests. Then, if anyone ever needs OAuth for non-REGISTER requests, a separate draft can be written.
>>> 
>>> Really? Normally, for a secure solution, every SIP request, including requests sent by UA in dialog established from the 
>>> server to the registered end point must be authenticated. OAuth for REGISTRER requests only is kind of useless since it 
>>> does not allow UA to send any messages to the server without some additional authentication mechanism.
>>
>> Not sure what you mean by "secure solution", but UAs can still use SIP Digest authentication.
>>
>> What I am saying is that only use-case for SIP OAuth I am aware of is for REGISTER.
>
> How do they get these SIP Digest credentials?
>
> I am looking at a very simple SIP-Over-Websockets client scenario:
>
> User logs into the web site which uses OAuth. UA, running in the browser gets a token which is used to Register UA with a SIP proxy.

Wouldn't  you use OAuth to establish the WebSocket connection?

>What credentials is UA using to place a call (send INVITE to the proxy)? 
>If a call comes in from the proxy to UA, what credentials is UA using to hang up the call (send BYE message)?

If the registry and the call handling is part of the same service I guess you could use the same credentials, assuming 3261 generally allows using the same credentials for registrations and calls.

Regards,

Christer