Subject: [sipcore] Doc Shepherd review of draft-ietf-sipcore-sip-token-authnz-08

From: "A. Jean Mahoney" <[email-masked]>
Date: Sun, 23 Feb 2020 15:29:38 -0600

Hi all,

Below is my review of -08.

Thanks!

Jean

Abstract -  To better define what the document covers, perhaps:

    This document defines the "Bearer" authentication scheme for
    the Session Initiation Protocol (SIP), and a mechanism by
    which user authentication and SIP registration authorization
    is delegated to a third party, using the OAuth 2.0 framework
    and OpenID Connect Core 1.0.  This document updates RFC 3261
    to provide guidance on how a SIP User Agent Client (UAC)
    responds to a SIP 401/407 response that contains multiple
    WWW-Authenticate/Proxy-Authenticate header fields.

Copyright - Does the document need a disclaimer for pre-RFC5378 work?

Section 1. Introduction

The introduction should provide some text about the single-signon use 
case.

I would pull the Example Flows section forward to be part of the 
Introduction.

Section 1.2  SIP User Agent Types

I think that this section should include a brief, non-normative 
discussion of how a UAC can act on an HTTPS URL - RFC8252 for Native 
Apps (user interacts with the authorization server with a browser), 
RFC8628 for browserless devices, and that there may be other ways in the 
future.

Section 2.1  UAC Behavior

Should provide more guidance on token expiration.

Section 2.1.1  Obtaining Tokens

Add references for the token types.

Section 2.2. UAS and Registrar Behavior

Should provide more guidance on token expiration.

Section 3. Access Token Claims

Add info about reference token (or maybe that should go in the Intro)

Section 8.  Acknowledgments

Yehoshua Gev should also get a nod in this section.

Nits:

See the pull request for specifics.
https://github.com/rifaat-ietf/draft-ietf-sipcore-sip-token-authnz/pull/5/commits/a653c1a5f1184f3eeb5ccabd101f0d6a0053a6b1