Subject: RE: [Simple] "last call" on SIMPLE-XMPP interworking I-D

From: <[email-masked]>
Date: Wed, 12 Jul 2006 08:51:51 +0200

Hello, 

I have one question not directly related to the interworking, but to one
comment from Adam:

>3. Subscription Permission Indication
>
>    The receipt of a 200-class response to a SUBSCRIBE message means
>    that the SUBSCRIBE message has been received. It does not mean that
>    permission to subscribe to the resource has been granted. The only
>    way to know that permission to subscribe to the resource has been
>    granted is the receipt of a NOTIFY message with a
>    "Subscription-State:" header field of "active".

>From rfc3265, 3.1.6.1 Initial SUBSCRIBE Transaction Processing:
...
   If the notifier is able to immediately determine that it understands
   the event package, that the authenticated subscriber is authorized to
   subscribe, and that there are no other barriers to creating the
   subscription, it creates the subscription and a dialog (if
   necessary), and returns a "200 OK" response (unless doing so would
   reveal authorization policy in an undesirable fashion; see section
   5.2.).

   If the notifier cannot immediately create the subscription (e.g., it
   needs to wait for user input for authorization, or is acting for
   another node which is not currently reachable), or wishes to mask
   authorization policy, it will return a "202 Accepted" response.  This
   response indicates that the request has been received and understood,
   but does not necessarily imply that the subscription has been
   authorized yet.
...

>From the above, it seems to me that 200 OK to SUBSCIBE means that the
permission has been granted. Or am I wrong?

Thanks, 

Silvestr Peknik
TietoEnator

_______________________________________________
Simple mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/simple

---

From: Adam Roach <[email-masked]>
Date: Wed, 12 Jul 2006 10:42:00 -0400

> permission has been granted. Or am I wrong?

You are correct. A 200 response, as specified, generally should indicate 
that permission has been granted. That cannot be inferred from all 
200-class responses. Some confusion has arisen in the time since 3265 
was published regarding handling of 200-class responses that are neither 
200 nor 202. Per 3261, these should be treated at 200s; however, this 
can't always be a valid assumption.

In practice, I've noted that many, many implementations get the 200/202 
distinction wrong.

On the other hand, it's *always* safe to assume an active subscription 
upon receipt of a NOTIFY with an active subscription state.

/a

---

From: Robert Sparks <[email-masked]>
Date: Thu, 13 Jul 2006 09:06:14 -0400

>
> You are correct. A 200 response, as specified, generally should  
> indicate that permission has been granted. That cannot be inferred  
> from all 200-class responses. Some confusion has arisen in the time  
> since 3265 was published regarding handling of 200-class responses  
> that are neither 200 nor 202. Per 3261, these should be treated at  
> 200s; however, this can't always be a valid assumption.
>
> In practice, I've noted that many, many implementations get the  
> 200/202 distinction wrong.
>
> On the other hand, it's *always* safe to assume an active  
> subscription upon receipt of a NOTIFY with an active subscription  
> state.

To reinforce this:

Using the initial notify is always safer - to the point that I would  
gladly accept deprecation of 202 and go back to just 200.

1) If you fork, you're only going to get one of the branches' 2xx  
back. You'll have to look at the NOTIFYs anyhow
     to know which legs are active
2) The initial notify(s) are quite likely to beat the 2xx to the  
subscribe back anyhow.

RjS