Re: [sipcore] I-D Action: draft-ietf-sipcore-sip-token-authnz-02.txt

[Rifaat Shekh-Yusef <[e-mail]>]

This document is specifically focused on *confidential *UAs.
UAs running in the browser, public UAs, will be addressed in a separate
document.

Regards,
 Rifaat


On Tue, Jul 9, 2019 at 3:29 PM Roman Shpount <[e-mail]> wrote:

> On Tue, Jul 9, 2019 at 3:11 PM Christer Holmberg <
> [e-mail]> wrote:
>
>> >> As far as I know, OAuth for SIP has only been used for REGISTER
>> requests, between the UA and the registrar.
>> >> I have never heard about anyone using it for non-REGISTER
>> authentication, and I wonder whether we even need
>> >> to cover it in the draft. We could limit the scope the REGISTER
>> requests. Then, if anyone ever needs OAuth for non-REGISTER requests, a
>> separate draft can be written.
>> >
>> > Really? Normally, for a secure solution, every SIP request, including
>> requests sent by UA in dialog established from the
>> > server to the registered end point must be authenticated. OAuth for
>> REGISTRER requests only is kind of useless since it
>> > does not allow UA to send any messages to the server without some
>> additional authentication mechanism.
>>
>> Not sure what you mean by "secure solution", but UAs can still use SIP
>> Digest authentication.
>>
>> What I am saying is that only use-case for SIP OAuth I am aware of is for
>> REGISTER.
>>
>> How do they get these SIP Digest credentials?
>
> I am looking at a very simple SIP-Over-Websockets client scenario:
>
> User logs into the web site which uses OAuth. UA, running in the browser
> gets a token which is used to Register UA with a SIP proxy.
>
> What credentials is UA using to place a call (send INVITE to the proxy)?
> If a call comes in from the proxy to UA, what credentials is UA using to
> hang up the call (send BYE message)?
>
> Best Regards,
> _____________
> Roman Shpount
>
> _______________________________________________
> sipcore mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/sipcore
>