Subject: [SIP] Third-party registration

From: Laurent-Walter Goix <[email-masked]>
Date: Tue, 25 Jul 2000 17:43:59 +0200

I need some clarification about some security considerations in
third-party registration that I haven't found in the archive. I maybe
miss them...

Draft rfc2543bis shows in section 16.1 an example of a third-party
registration with the secretary registering his boss. Section 4.2.6
specifies From header as the "address-of-record of the person
responsible for the registration".

Now my doubts:
- As one can understand, and as I haven't found any security
consideration about it, there is only one person who can be responsible
for a certain "address-of-record" (her own or anyone else). Is the
security check performed at the registrar depending on its
implementation or is there some standard specification? To reuse the
example, can the boss registers itself (I would be quite logical...) or
only his secretary can do it since she is responsible for his
registration?

- Then if someone can register someone else's address, is there any
authentication check performed by the registrar based on a
"responsible-for-M.X" addresses list in some database or even after some
authentication process (based on the From header) ?

Authentication header is only optional in REGISTER requests, but why
isn't it mandatory in case of some third-party registration request to
avoid misbehaviours (or shouldn't the server automatically responds a
401 Unauthorized when the header wasn't found)?

Thanks,

Laurent-Walter Goix

---

From: Jonathan Rosenberg <[email-masked]>
Date: Tue, 25 Jul 2000 12:45:09 -0400

Laurent-Walter Goix wrote:
> for a certain "address-of-record" (her own or anyone else).

No. Any number of people can send a third party registration. In the
example, the secretary, the boss, and the boss's husband could all send
registrations for the boss (i.e., the To field in all these contains
sip:[email-masked]).

> Is the

Authorization policy is your own decision. If your service wishes to
restrict people to only register themselves, thats your decision.

> authentication process (based on the From header) ?

Don't confuse authentication and authorizaiton. Authentication is "who
are you", authorization is "can you do X". You would authenticate a
REGISTER as coming from the user in the From field. Once authenticated
(yes, this is the secretary), the authorization decision tells you
whether this person can perform the desired action. The authorization
decision can be arbitrarily complex and is a matter of policy.

> 401 Unauthorized when the header wasn't found)?

If your servers authorization policy is to allow anyone to register for
anyone else, you don't need to authenticate the requests. Thus, whether
you use/need authentication is at the discretion of the administrator.

-Jonathan R.
-- 
Jonathan D. Rosenberg                       72 Eagle Rock Ave.
Chief Scientist                             First Floor
dynamicsoft                                 East Hanover, NJ 07936
[email-masked]                     FAX:   (973) 952-5050
http://www.cs.columbia.edu/~jdrosen         PHONE: (732) 741-7244
http://www.dynamicsoft.com

_______________________________________________
SIP mailing list
[email-masked]
http://lists.bell-labs.com/mailman/listinfo/sip