Re: [sipcore] Benjamin Kaduk's Discuss on draft-ietf-sipcore-sip-token-authnz-13 - DISCUSS Reply

[Benjamin Kaduk <[e-mail]>]

On Sat, Apr 25, 2020 at 11:27:34PM +0000, Christer Holmberg wrote:
> Hi Benjamin,
>  
> >> Section 2.3 states that:
> >>
> >>   When a proxy wishes to authenticate a received request, it MUST
> >>   search the request for Proxy-Authorization header fields with 'realm'
> >>   parameters that match its realm.  It then MUST successfully validate
> >>
> >> https://tools.ietf.org/html/rfc7235#section-4.4 suggests that it is not
> >> expected to have a sequence or list of Proxy-Authorization header fields
> >> present in a single request that are intended to be interpreted by different
> > proxies.  Is this text compatible with that part of RFC 7235? 
> 
> RFC 3261 allows multiple Proxy-Authorization header fields.

Ah, thanks.

> > Furthermore, I didn't find much guidance in 7235 or 3261 about when to include the
> > "realm" parameter in Proxy-Authorization; do we want to give any guidance
> > here?  (That is to say, I almost didn't find where it was even defined as
> > possible to do so...)
> 
> I think it is clear from Section 22.3 (and the example in Section 20.28) in RFC 3261 that the "realm" is included in the Proxy-Authorization header field.

So it is, thanks for the pointer and sorry for having missed it.

> If we think 7235 and/or 3261 needs to be improved regarding that I think it is a separate task, outside the scope of this document.

Okay; in light of the above I don't see a pressing need to do anything in
this document.

Thanks,

Ben

> (The thread Rifaat mentioned is not really related to this. It is whether the UAC provides credentials for one or more schemes.)
> 
> Regards,
> 
> Christer
> 
> 
> 
>