Re: [sipcore] I-D Action: draft-ietf-sipcore-sip-token-authnz-02.txt

[Christer Holmberg <[e-mail]>]

Hi,

>>   What we are discussing is standardizing scope information in the draft. If I understand correctly, you don't need that for the basic mechanism to work - you only need it if you want to include authorization information in the token. In case of registration, if the SIP server has that information, it is not needed.
>
>   Also, in the case of SSO, couldn't you use the token for more things than SIP? In that case I assume you don't want to scope it to SIP only.
>
> Please read section 3.3 of the Oauth 2.0 Security Best Current Practise.
> https://tools.ietf.org/html/draft-ietf-oauth-security-topics-13
>
> "In particular, access tokens SHOULD be restricted to certain resource servers, preferably to a single resource server. “

Fair enough. I'll let Rifaat continue the SSO discussion, if needed, because he is more interested in that.

My main interest is using Oauth tokens for SIP registrations only, so that should be aligned with the BCP :)

> So no, I don’t wan’t the access token used for SIP used for anything else. When the client requests authorization you propably want to request a specific resource server (SIP domain)
> that this token applies to. Most examples in the docs refer to HTTPS URI’s, but the spec keeps saying “URI” so I assume a SIP domain uri or a sip server URI would work too. 
> This is all in theory of course, I don’t know what kind of core dump or other hiccup a SIP URI would generate in current OAuth2 implementations ;-)

HTTP is referring to the OAuth2 interfaces etc (we are not defining a SIP OAuth interface) We can double check whether instances of "URI" should be more specific.

> Any recommendations on Open Source Oauth2 servers to play around with, btw?

Unfortunately not.

Regards,

Christer