Subject: RE: [Simple] xcap/geopriv alignment issue 4: authentication

From: [email-masked]
Date: Mon, 24 Nov 2003 13:54:15 +0200

Can the user at least have a say in accepting or rejecting the subscription based on the availability of any authentication type. Eg: A user can reject subscriptions that are not authenticated in any way and accept subscriptions that are authenticated, regardless of authentication type.

Regards,
Hisham

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On Behalf Of
> ext Jonathan Rosenberg
> Sent: 24.November.2003 08:13
> To: Simple WG
> Subject: [Simple] xcap/geopriv alignment issue 4: authentication
> 
> 
> Folks,
> 
> Currently, xcap-auth defines an authentication condition. This allows 
> you to decide whether to accept or reject a subscription based on the 
> type of authentication used in the SUBSCRIBE request.
> 
> The geopriv policy specification currently has no such mechanism.
> 
> This was discussed during the geopriv meeting in Minneapolis. If you 
> think about it for a bit, its not clear how this would actually get 
> used. Remember, it is end users that will set these policies. What 
> kind of meaningful information can be provided to a user about the 
> differences between p-asserted-id and sip-identity and digest 
> authentication? What would make a user give permission for 
> one type or 
> authentication, and not another? Practically speaking, it doesnt seem 
> like its easy to use at all.
> 
> As a result, I would propose to remove the authentication condition 
> from xcap-auth.
> 
> Comments?
> 
> -Jonathan R.
> -- 
> Jonathan D. Rosenberg, Ph.D.                600 Lanidex Plaza
> Chief Technology Officer                    Parsippany, NJ 07054-2711
> dynamicsoft
> [email-masked]                     FAX:   (973) 952-5050
> http://www.jdrosen.net                      PHONE: (973) 952-5000
> http://www.dynamicsoft.com
> 
> 
> 
> _______________________________________________
> Simple mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/simple
> 

_______________________________________________
Simple mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/simple

---

From: Ben Campbell <[email-masked]>
Date: Mon, 24 Nov 2003 15:00:23 -0600

> Can the user at least have a say in accepting or rejecting the subscription based on the availability of any authentication type. Eg: A user can reject subscriptions that are not authenticated in a…

In the absence of _some_ authentication, what is the value of having 
authorization policies in the first place? They have no meaning if you 
cannot put some degree of trust in the requestor identity.

I think the email world has proven to us how useful it is to authorize 
on un-authenticated headers. How useful is a spam filter that relies on 
the From header?

---

From: Ben Campbell <[email-masked]>
Date: Mon, 24 Nov 2003 15:00:23 -0600