Subject: Re: [sipcore] SIP/websocket: SIP Identity question

From: binod pg <[email-masked]>
Date: Thu, 07 Nov 2013 10:03:52 +0530

I have few more further questions on this section.

1. The text in section 7 does not talk about which SIP header contains 
SIP identity that
     will be used for matching against the SIP Identity associated to 
the websocket
     connection. Section A.2 mentions it as From URI value. But A.2 is 
non-normative.
     So, will it be always From URI? In a discussion in SIP servlet 
expert group a question
     was asked, whether it can be P-Asserted-Identity. Can it be?

2. Doesn't the requirement for matching implies that the user can not 
use more than
     one SIP identity(eg: IMPU)?

3. If a user want to keep the SIP identity private/anonymous (RFC 3323), 
would the rule for
     matching the SIP identity still apply?

thanks,
Binod.

On 10/21/2013 9:50 AM, Binod wrote:
> Hi,
>
> Section 7 of sip/websocket says the following.
>
>    If SIP Digest authentication is not requested for SIP requests coming
>    from the SIP WebSocket Client, then the SIP WebSocket Server MUST
>    authorize SIP requests based on a previous Web or WebSocket login /
>    authentication procedure, and MUST validate that the SIP identity in
>    those SIP requests match the SIP identity associated to the WebSocket
>    connection.
>
> I assume, the "SIP identity associated to the WebSocket connection" is 
> not
> exactly the same as the "web identity" associated with the websocket 
> connection.
>
> The RFC draft does not explain how the SIP WebSocket Server maps the
> "web identity" (example: the username with which user logs into a 
> website)
> to the "sip identity".
>
> So, the "matching" specified in section 7, happens "after" a potential 
> mapping
> between "web identity" and "sip identity".
>
> Did I get it right?
>
> Hope draft is not mandating that username with which user logs into 
> the website
> must match with the sip identity present in the SIP request.
>
> thanks,
> Binod.
>
> _______________________________________________
> sipcore mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sipcore

---

From: Dean Willis <[email-masked]>
Date: Thu, 7 Nov 2013 23:57:49 -0600

On Nov 6, 2013, at 10:33 PM, binod pg <[email-masked]> wrote:

> 1. The text in section 7 does not talk about which SIP header contains SIP identity that
>    will be used for matching against the SIP Identity associated to the websocket
>    connection. Section A.2 mentions it as From URI value. But A.2 is non-normative.
>    So, will it be always From URI? In a discussion in SIP servlet expert group a question
> 2. Doesn't the requirement for matching implies that the user can not use more than
> 3. If a user want to keep the SIP identity private/anonymous (RFC 3323), would the rule for

Congratulations. You have found the elephant in the room that others have been tiptoeing around without mentioning.

SIP Identity is broken, and needs to be fixed before any other standard can reasonably build on it. Most IMS systems will use the P-Asserted-Identity header for this role, but outside of IMS, it’s absolute mayhem.

There’s ongoing work in STIR on a completely analogous issue for telephone number identity assertions. It would be nice to converge on a unified approach.

—
Dean

---

From: binod pg <[email-masked]>
Date: Mon, 11 Nov 2013 14:38:07 +0530

From  the sip/websocket draft perspective, "MUST" in the following sentence
is creating the confusion for a reader.

<snip>
    and*MUST*validate that the SIP identity in
    those SIP requests match the SIP identity associated to the WebSocket
    connection
</snip>

Either the spec should clearly state what the "SIP identity" actually mean (see
the questions below) or if everyone know that the "SIP identity" is broken and cannot be used
consistently, reword the sentence to not mandate the validation.

- Binod.

---

From: Iñaki Baz Castillo <[email-masked]>
Date: Fri, 29 Nov 2013 03:02:41 +0100

2013/11/11 binod pg <[email-masked]>:
>    and MUST validate that the SIP identity in

I agree and such a sentence is removed for the next version of the
draft (to be published in a few minutes).

I've been thinking on it a lot and definitely it makes no sense at all
to assume that there are "webSocket user" and "SIP user", even less
than they "should match".

-- 
Iñaki Baz Castillo
<[email-masked]>