Subject: Re: [Simple] Usage of Contact header in PUBLISH for application authentication ?

From: "CORVOYSIER David RD-MAPS-REN" <[email-masked]>
Date: Thu, 21 Oct 2004 14:57:55 +0200

I'm jumping into that thread because the use case described by bernhard is one of those I am also struggling with (presence published on behalf of a presentity) ...

So, from your answer I understand that TLS will authenticate the application server towards the presence server, but does this also mean that the presence server delegates user authentication to the application server ?
In that case how can the application server be sure that the user is allowed to publish presence for the presentity ? I am probably missing something but it seems to me that without some kind of control a user authenticated by the app server could possibly publish presence for anyone ...

--------------------------------
David Corvoysier
France Telecom R&D 
http://www.rd.francetelecom.com/
-------------------------------- 

> -----Message d'origine-----
> De : [email-masked] [mailto:[email-masked]] 
> De la part de Jonathan Rosenberg
> Envoyé : jeudi 21 octobre 2004 05:24
> À : Boehmer Bernhard ICM Berlin
> Cc : 'Aki Niemi'; SIMPLE WG
> Objet : Re: AW: [Simple] Usage of Contact header in PUBLISH 
> for applicationa uthentication ?
> 
> For cases where an application server is publishing, the 
> right thing is to use mutual TLS between the application 
> server and the presence server. The TLS certificates indicate 
> the identity of the element generating the publish. There is 
> no need for p-a-id here; the presence document would contain 
> the identity of the presentity. Authorization policies in the 
> presence server would typically make sure that the given 
> application server can publish state for that presentity.
> 

_______________________________________________
Simple mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/simple

---

From: Mauricio Arango <[email-masked]>
Date: Thu, 21 Oct 2004 13:35:39 -0400

Use of TLS between the app server and the presence
server seems to assume that the PUBLISH request isn't
routed through multiple intermediate SIP proxies, which
shouldn't be a valid assumption even when both
the app server and the presence server are in the
same administrative domain.

I believe the problem of a presence server
authenticating the source of a PUBLISH request
(application server) is provided in in draft-ietf-sip-identity-03.

The other question you pose is how does the application
server can authenticate the source of presence the information
it collects. If the app server is in turn a SIMPLE presence
server, then the approach in draft-ietf-sip-identity-03
can also be applied to its presence sources. If it isn't then
a similar approach should be proposed via the use of
authentication assertions granted by an authentication provider
with which the presence sources authenticate.

Mauricio Arango