Re: [tram] signature based 3rd party scheme

Picking this up again ...

I think that part of the disconnect here is that we're discussing 
authentication of two different parties (the user and the WebRTC server) 
as if they were the same entity. I think it's possible for the TURN 
service to have in interest in authenticating each of these independently.

For example, I can see the possibility of a TURN server being made 
available to authorized users but only for a set of specific 
pre-approved services where the owner of the TURN server and the owner 
of the WebRTC server(s) have no pre-arranged relationship. In this case, 
it would be desirable for the TURN server to be able to authenticate 
both the user and the WebRTC server, but the two authentications would 
be distinct, since being an authorized user of the WebRTC service is not 
enough to allow access to the TURN server. In this case, Stephen's 
suggested signature based authentication of the WebRTC server would be 
useful, while user-level authentication would be handled via one of the 
other methods.

Additionally, I can see the possibility that such a TURN server is 
deployed in such a way that the owner does not require any user-level 
authentication at all. For example, an ISP might offer such a service to 
its end users and might not consider it valuable to require user-level 
authentication for the relay since it already has per-subscriber 
authentication of some sort for access to its network. IOW, there is a 
desire to authenticate the WebRTC server but no corresponding desire to 
explicitly authenticate the user.

If this is the requirement set, and especially (though not only) if DTLS 
is in use for the client-to-TURN connection, signature based 
authentication of the WebRTC server would be the only required TURN 
authentication for the session.

--Brandon

On 04/30/2015 11:56 PM, Tirumaleswar Reddy (tireddy) wrote:
>> -----Original Message-----
>> From: Stephen Farrell [mailto:stephen.farrell@cs.tcd.ie]
>> Sent: Thursday, April 30, 2015 10:37 PM
>> To: Tirumaleswar Reddy (tireddy); tram@ietf.org
>> Subject: Re: [tram] signature based 3rd party scheme
>>
>>
>>
>> On 30/04/15 17:58, Tirumaleswar Reddy (tireddy) wrote:
>>>>>
>>>>> Indeed, if the current draft were the only way to do this then all
>>>>> enterprises would have to pre-arrange things with all WebRTC servers.
>>> No, pre-arrangement is not required with all WebRTC servers.
>>
>> Sorry, how?
>
> It is discussed in http://tools.ietf.org/html/draft-ietf-tram-turn-third-party-authz-15#section-6.1. If WebRTC server has pre-arrangement with the Enterprise network then client uses third party authorization with the TURN server in Enterprise network and when WebRTC server(s) do not have any pre-arrangement with the Enterprise network then the client uses first party authentication with the TURN server.
>
> -Tiru
>
>>
>> S.
>
> _______________________________________________
> tram mailing list
> tram@ietf.org
> https://www.ietf.org/mailman/listinfo/tram
>

-- 
Brandon Williams; Chief Architect
Cloud Networking; Akamai Technologies Inc.