Re: [sipcore] I-D Action: draft-ietf-sipcore-sip-token-authnz-02.txt

Roman Shpount <roman@telurix.com> Wed, 10 July 2019 23:15 UTC

Return-Path: <roman@telurix.com>
X-Original-To: sipcore@ietfa.amsl.com
Delivered-To: sipcore@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A668F120222 for <sipcore@ietfa.amsl.com>; Wed, 10 Jul 2019 16:15:16 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.592
X-Spam-Level:
X-Spam-Status: No, score=-0.592 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, PDS_NO_HELO_DNS=1.295, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, T_SPF_PERMERROR=0.01, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=telurix-com.20150623.gappssmtp.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 64V8bYephEOk for <sipcore@ietfa.amsl.com>; Wed, 10 Jul 2019 16:15:14 -0700 (PDT)
Received: from mail-pl1-x62e.google.com (mail-pl1-x62e.google.com [IPv6:2607:f8b0:4864:20::62e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D3F5B120019 for <sipcore@ietf.org>; Wed, 10 Jul 2019 16:15:14 -0700 (PDT)
Received: by mail-pl1-x62e.google.com with SMTP id c2so1955054plz.13 for <sipcore@ietf.org>; Wed, 10 Jul 2019 16:15:14 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=telurix-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=Em17Weswk2DkevW6A793LpQ9scCWcYRChmNehjJXlYE=; b=SUft7pN4J4OuMRJYgoCET154cszYikT8wViYu3pyC+aOglcLvAmE4MCQSmXha69zDm 1T3zz+c9tIjHi4b+vZSLKDuIy8VM3mShGASb8nqLeDs7en2KHdm5eSt32ViGM9yS3niU 7BPBhivFi0FoPujiEWS1obB1JgnWVXiabG2K+vsI4ZpFztp+bl1rjbSX5dK57igkcdrD I0vFXpfA9NFW2iDb+RDWetobbosEsTrkTW05JnARVYBn6RmpTAg+Ed3jsnBJc6qKa5q7 nrAcoXOON4qjBRWGO7Q1mfZi8unjdgMOwUbcilXr89dAUgt4LvrRLr2aCe3c4O80TvSx A6Gg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=Em17Weswk2DkevW6A793LpQ9scCWcYRChmNehjJXlYE=; b=VDBom3HRV1Pn2qiwmU5lQaBveI5T522I0873ab96nv6Epxt9bv3SjsetM00NsSL40c 5TyPdBgMWEjcmrZbntRJ4TDSxkbSachAEmuStnRr5R0hHQjQJXJ2OJX4DvRqHY8jW12r K9vSFfkHweyWhw1VvMMU36HbX5gbZ5oEYwxjDLM2D8VGaCLh6a2nu+LOAzwG6p25PheH 2NOcnQDPpgE7gsPlJooplA2ipEtNMwu6kDfRWCFDM8KtHxr7OVVO3GfC2y/CeIbBE2/s x7snbs7FSDAtiO8bdq81XpRDCDwKAYadxTCW/hHv01+F3gedDNx5OZkwC4J16rP4l2cz Hg6Q==
X-Gm-Message-State: APjAAAX4opnArs0h6z8IsVrUrsg8z+sqapI9mFVHfGllORtI+a4vNf3a h/gqsGBtDrWOW4o8Su2Rbg+UU4/v
X-Google-Smtp-Source: APXvYqwecUPEgHjpa1yIdMVAvKul+cdZWyT81e88ohyrlegLleWFtPp0qX+5sWsHoaNq/rqSTj8irQ==
X-Received: by 2002:a17:902:28:: with SMTP id 37mr823297pla.188.1562800514111; Wed, 10 Jul 2019 16:15:14 -0700 (PDT)
Received: from mail-pl1-f174.google.com (mail-pl1-f174.google.com. [209.85.214.174]) by smtp.gmail.com with ESMTPSA id f197sm3091558pfa.161.2019.07.10.16.15.13 for <sipcore@ietf.org> (version=TLS1_3 cipher=AEAD-AES128-GCM-SHA256 bits=128/128); Wed, 10 Jul 2019 16:15:13 -0700 (PDT)
Received: by mail-pl1-f174.google.com with SMTP id c2so1955014plz.13 for <sipcore@ietf.org>; Wed, 10 Jul 2019 16:15:13 -0700 (PDT)
X-Received: by 2002:a17:902:20c8:: with SMTP id v8mr881482plg.284.1562800512798; Wed, 10 Jul 2019 16:15:12 -0700 (PDT)
MIME-Version: 1.0
References: <156249821133.14592.1211919336596009446@ietfa.amsl.com> <CAGL6epLsP_UfZMAcFLsORrR05Enu-vp=jnkgUFuKSttQm8swAw@mail.gmail.com> <c8d5c42e-ab21-80e8-3189-c8592dd02d3a@alum.mit.edu> <HE1PR07MB3161C55955B2FCED2C0F6A9993F60@HE1PR07MB3161.eurprd07.prod.outlook.com> <68ed93ae-57df-6bc7-774b-47959417abda@alum.mit.edu> <HE1PR07MB3161D46B4A44FC7E789ADDB893F10@HE1PR07MB3161.eurprd07.prod.outlook.com> <4a9787e5-b5e2-bc08-0fa0-fae6bd44148d@alum.mit.edu> <527F4C39-F065-4335-A939-6D443F1801E7@ericsson.com> <CAD5OKxuK_2+JcbGvo6LNeRbCYXWXQmhKQPNUzoZvZEOupPWyjw@mail.gmail.com> <HE1PR07MB3161612130F07C8F727A2BB693F10@HE1PR07MB3161.eurprd07.prod.outlook.com> <CAD5OKxtR-WBhfa4msbAfXoK7JowYaKK3fSCbw0cXm6SRGwkLxg@mail.gmail.com> <HE1PR07MB3161434F0C9714266EF22DF093F10@HE1PR07MB3161.eurprd07.prod.outlook.com> <CAD5OKxtyGEkxbmTMLyTa6VObrQQTUGLFRHiGm1OaS2SaY+SurA@mail.gmail.com> <FC8A6410-E6C4-456F-951E-5BC39A461430@edvina.net>
In-Reply-To: <FC8A6410-E6C4-456F-951E-5BC39A461430@edvina.net>
From: Roman Shpount <roman@telurix.com>
Date: Wed, 10 Jul 2019 19:15:04 -0400
X-Gmail-Original-Message-ID: <CAD5OKxvLoyFJKCywNMaUe6wvQOxru+-kwkcviW+9pPz-AhHbdw@mail.gmail.com>
Message-ID: <CAD5OKxvLoyFJKCywNMaUe6wvQOxru+-kwkcviW+9pPz-AhHbdw@mail.gmail.com>
To: "Olle E. Johansson" <oej@edvina.net>
Cc: Christer Holmberg <christer.holmberg@ericsson.com>, "sipcore@ietf.org" <sipcore@ietf.org>
Content-Type: multipart/alternative; boundary="0000000000006b9747058d5bd99e"
Archived-At: <https://mailarchive.ietf.org/arch/msg/sipcore/m82543DooyqoFaNC1JBlAp0aoKM>
Subject: Re: [sipcore] I-D Action: draft-ietf-sipcore-sip-token-authnz-02.txt
X-BeenThere: sipcore@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: SIP Core Working Group <sipcore.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/sipcore>, <mailto:sipcore-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/sipcore/>
List-Post: <mailto:sipcore@ietf.org>
List-Help: <mailto:sipcore-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/sipcore>, <mailto:sipcore-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 10 Jul 2019 23:15:17 -0000

On Wed, Jul 10, 2019 at 2:54 AM Olle E. Johansson <oej@edvina.net> wrote:

> Wouldn't  you use OAuth to establish the WebSocket connection?
>>
>
> No, WebSocket connection is to a different server and typically does not
> require authentication.
>
> I don’t think that’s correct. See section 7 of RFC 7118 - SIP over WS.
> https://tools.ietf.org/html/rfc7118#section-7
>

 These options are certainly valid but I some times complicate things. As I
have mentioned, if registrar and edge proxy are two different servers,
using connection based authentication complicates things.

> In this specific case, I was thinking OpenSIPS with SIP-over-WS support.
> Implementing OAuth authentication of SIP message would be trivial there,
> but OAuth authentication for WebSocket would be much less obvious.
>
> That’s implementation. I am pretty sure that Kamailio can auth the
> websocket, either by TLS client cert or HTTP digest auth. Guess I need to
> test :-)
>

As I have said, it is probably doable but much less obvious, especially in
the scenario where proxy and registrar are separate.

> >What credentials is UA using to place a call (send INVITE to the proxy)?
>> >If a call comes in from the proxy to UA, what credentials is UA using to
>> hang up the call (send BYE message)?
>>
>> If the registry and the call handling is part of the same service I guess
>> you could use the same credentials, assuming 3261 generally allows using
>> the same credentials for registrations and calls.
>>
>
> Are you saying using OAuth token authentication for calls (INVITE) and in
> dialog messages (BYE)?
>
> Why not? It’s just a different Authorization header value. In my view
> Oauth bearer tokens should be usable in all places where you today have MD5
> digest auth.
>
> I was trying to figure out exactly this. I was trying to see why Christer
says that OAuth should not cover requests other then registration. That
seemed strange to me.
_____________
Roman Shpount