Subject: Re: [Simple] xcap/geopriv alignment issue 4: authentication

From: Alex Audu <[email-masked]>
Date: Mon, 01 Dec 2003 15:18:43 -0600

I think being able to decide whether to accept or reject a subscription based on
the type of authentication used in the SUBSCRIBE request is useful. That would
allow me, for example, to reject clients using a less secure authentication scheme
or force them to use a more secure one (e.g. Basic Access Authentication vs
Digest Access Authentication).

Regards,
Alex.

"Vesa Torvinen (JO/LMF)" wrote:

> Hi,
>
> [Tried to send something on this before but haven't seen my mail on the list... this is the second try.]
>
> I think this was originally related to a use case where a policy would define that "anyone that knows the password is allowed to subscribe". The presentity wouldn't exactly be interested in authentication in terms of identities (the watcher could be "anonymous") - just to be sure that all authorized watchers know the password. This use case is similar to the policies currently used in phone conferencing systems, i.e. the participant just needs to know the conference id, and related password - and not really to authenticate himself in terms of real identity. One problem is, of course, that the password should be specific to the presentity, e.g. "realm=[email-masked]", not to the "realm=domain.com" as a whole.
>
> There has also been some discussion in 3GPP/SA3 on having an option for using a password based authentication in addition to the P-Asserted-Identity header based "authentication". Not all people like this idea, however, it could provide some additional security for 3GPP IP multimedia subsystem. For example, HTTP Digest AKA (that is used to create the P-Asserted-Identity) does not really authenticate the end-user - it authenticates the subscription/device.
>
> I agree that forcing the use of S/MIME, TLS or P-Asserted-Identity is not really meaningful. However, having policies that mandate the use of HTTP Digest (or some other password based mechanism) may still be useful.
>
> Vesa
>
> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On Behalf Of
> Jonathan Rosenberg
> Sent: 24. marraskuuta 2003 8:13
> To: Simple WG
> Subject: [Simple] xcap/geopriv alignment issue 4: authentication
>
> Folks,
>
> Currently, xcap-auth defines an authentication condition. This allows
> you to decide whether to accept or reject a subscription based on the
> type of authentication used in the SUBSCRIBE request.
>
> The geopriv policy specification currently has no such mechanism.
>
> This was discussed during the geopriv meeting in Minneapolis. If you
> think about it for a bit, its not clear how this would actually get
> used. Remember, it is end users that will set these policies. What
> kind of meaningful information can be provided to a user about the
> differences between p-asserted-id and sip-identity and digest
> authentication? What would make a user give permission for one type or
> authentication, and not another? Practically speaking, it doesnt seem
> like its easy to use at all.
>
> As a result, I would propose to remove the authentication condition
> from xcap-auth.
>
> Comments?
>
> -Jonathan R.
> --
> Jonathan D. Rosenberg, Ph.D.                600 Lanidex Plaza
> Chief Technology Officer                    Parsippany, NJ 07054-2711
> dynamicsoft
> [email-masked]                     FAX:   (973) 952-5050
> http://www.jdrosen.net                      PHONE: (973) 952-5000
> http://www.dynamicsoft.com
>
> _______________________________________________
> Simple mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/simple
>
> _______________________________________________
> Simple mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/simple

_______________________________________________
Simple mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/simple

---

From: Alex Audu <[email-masked]>
Date: Mon, 01 Dec 2003 15:18:43 -0600

Regards,
Alex.