Subject: [Simple] Usage of Contact header in PUBLISH for application authentication ?

From: Boehmer Bernhard ICM Berlin <[email-masked]>
Date: Wed, 20 Oct 2004 11:08:08 +0200

Hi,
currently we consider the following scenario for PUBLISH:
An application is publishing on behalf of a user (presentity)
some presence information. However, the presence server needs
a means to authenticate the application server. The idea was 
to use the Contact-header for this purpose since the From-header
is used to carry the presentity's address. However, the PUBLISH
draft says:
"The PUBLISH request MAY contain a Contact header field, but including
 one in a PUBLISH request has no meaning in the event publication
 context and will be ignored by the ESC." 

Later in the draft, ignoring the contact header is even mandated. 
Could someone help me with this issue, please?

			Regards Bernhard
___________________________
 Dr. Bernhard Böhmer
 Systems Engineering
 Siemens AG Communications,
 Mobile Networks AS BD C
 Siemensdamm 50, Berlin
 Fon: +49-30-386-22756
 Mobile: +49-178-7700119

_______________________________________________
Simple mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/simple

---

From: Aki Niemi <[email-masked]>
Date: Wed, 20 Oct 2004 15:29:14 +0300

Hi Bernhard,

The From has the same meaning in PUBLISH as in any other request: it
indicates from whom the request is coming. The Request-URI identifies
the presentity or resource to which the publication is targeted.

However, you probably don't want to take the contents of the From at
face value, but use something like Digest authentication instead. In
that case the "username" parameter in the Authorization will give you an
identity. In some systems, the request might already contain an asserted
identity which you can use as an authenticated identity.

Contacts have no meaning in publications, and that's why ESCs are
instructed to ignore them. In the future, someone might come up with a
valid reason to include one in a PUBLISH request, and that's the reason
for the "MAY". Even then, the ESC will ignore the Contact, simply
because the header still won't meaning in the publication context while
in some other context it might.

Cheers,
Aki