Subject: Proxy-Authenticate header field

From: [email-masked]
Date: Tue, 21 Sep 1999 14:30:14 -0600

Hello,

We have a question related to the Proxy-Authenticate header field of SIP.
The syntax for this is defined in RFC 2068 (HTTP) as follows:

          Proxy-Authenticate  = "Proxy-Authenticate" ":" challenge

          auth-scheme    = token

          auth-param     = token "=" quoted-string

          challenge      = auth-scheme 1*SP realm *( "," auth-param )

          realm          = "realm" "=" realm-value
          realm-value    = quoted-string

Would anyone know if there are any pre-defined values for auth-scheme 
and auth-param (probably defined in some other RFC?)?

Thanks,
Aparna

Aparna V.
Level 3 Communications.

---

From: Jonathan Rosenberg <[email-masked]>
Date: Tue, 21 Sep 1999 22:49:06 -0400

RFC2069 defines the format for digest authentication.

For basic authentication, see section 11 of rfc2068. Reading this
section several times, I agree its confusing, because a formal
definition of the basic challenge is missing. It should be something
like:

auth-scheme = token | basic-scheme | digest-scheme

basic-scheme = "Basic"

For basic, there are no auth-params defined.

I also noted the following terrible mistake in rfc2069:

   authentication are very similar to those already described.  Upon
   receiving a request which requires authentication, the proxy/server
   must issue the "HTTP/1.1 401 Unauthorized" header followed by a
   "Proxy-Authenticate" header of the form

     Proxy-Authentication     = "Proxy-Authentication" ":" "Digest"
                                   digest-challenge

   where digest-challenge is as defined above in section 2.1. The
   client/proxy must then re-issue the request with a Proxy-Authenticate
   header of the form

     Proxy-Authorization      = "Proxy-Authorization" ":"
                                   digest-response

   where digest-response is as defined above in section 2.1. When
   authentication succeeds, the Server may optionally provide a Proxy-
   Authentication-info header of the form

The names of the headers in the BNF are wrong! It should be
Proxy-Authenticate, not Proxy-Authentication. This seems to be fixed in
rfc2617, which obsoletes rfc2069. Note that rfc2617 was issued after
SIP.

-Jonathan R.

-- 
Jonathan D. Rosenberg                       Lucent Technologies
Member of Technical Staff                   101 Crawfords Corner Rd.
High Speed Networks Research                Holmdel, NJ 07733
FAX: (732) 834-5379                         Rm. 4C-526
EMAIL: [email-masked]
URL: http://www.cs.columbia.edu/~jdrosen

---

From: Henning Schulzrinne <[email-masked]>
Date: Wed, 22 Sep 1999 09:51:20 -0400

Jonathan Rosenberg wrote:

> rfc2617, which obsoletes rfc2069. Note that rfc2617 was issued after

The updated draft already mentions RFC 2617 instead of 2069.

-- 
Henning Schulzrinne   http://www.cs.columbia.edu/~hgs