Re: [sipcore] Benjamin Kaduk's Discuss on draft-ietf-sipcore-sip-token-authnz-13 - DISCUSS Reply

[Christer Holmberg <[e-mail]>]

Hi Benjamin,
 
>> Section 2.3 states that:
>>
>>   When a proxy wishes to authenticate a received request, it MUST
>>   search the request for Proxy-Authorization header fields with 'realm'
>>   parameters that match its realm.  It then MUST successfully validate
>>
>> https://tools.ietf.org/html/rfc7235#section-4.4 suggests that it is not
>> expected to have a sequence or list of Proxy-Authorization header fields
>> present in a single request that are intended to be interpreted by different
> proxies.  Is this text compatible with that part of RFC 7235? 

RFC 3261 allows multiple Proxy-Authorization header fields.

> Furthermore, I didn't find much guidance in 7235 or 3261 about when to include the
> "realm" parameter in Proxy-Authorization; do we want to give any guidance
> here?  (That is to say, I almost didn't find where it was even defined as
> possible to do so...)

I think it is clear from Section 22.3 (and the example in Section 20.28) in RFC 3261 that the "realm" is included in the Proxy-Authorization header field.

If we think 7235 and/or 3261 needs to be improved regarding that I think it is a separate task, outside the scope of this document.
 
(The thread Rifaat mentioned is not really related to this. It is whether the UAC provides credentials for one or more schemes.)

Regards,

Christer