Subject: [sipcore] draft-ietf-sipcore-sip-authn-02 - consider splitting

From: Yehoshua Gev <[email-masked]>
Date: Wed, 1 Aug 2018 16:18:20 +0300

Hi,

After some thoughts about how the various sections of draft are intended to
be used, I think you should consider splitting it to two drafts.

The draft currently describes two separate mechanisms:
1. Section 2 is intended for a UA as a way to perform login by entering
some sort of credentials.
   After entering the credential, the SIP Proxy maintains a state for
"remaining authenticated" with the Authorization Server.
   Possibly, the UA uses a novel (not defined by the OAuth RFCs) shared-key
mechanism for "remaining authenticated" with the SIP Proxy.
   Part of the mechanism described in this section is similar to steps A &
B of section 4 of RFC 6749 (OAuth).

2. Section 3 is intended for a UA which has means of obtaining OAuth access
token (e.g., web application).
   This section describes a how to convey this access token over SIP
messages.
   It is almost completely equivalent to RFC 6750 (OAuth Bearer token)
which does the same for HTTP.

I think that each of those mechanisms deserves a separate draft, because:
a. A UA will most probably implement only one of those mechanisms and not
both.
   (To say a UA/Proxy conforms to the draft - must both mechanisms be
implemented?)
b. The security considerations are different between them.
c. They correspond to different OAuth RFCs.
d. IMHO, the second mechanism is closer to be prepared to publication.

Regards,
Yehoshua

---

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Thu, 2 Aug 2018 14:40:07 -0400

Thanks Yehoshua,

I tend to agree with you, and I would be ok with splitting the document
into two.
It is up to the chairs and WG to make a decision on this.

*Chairs,*

Any thoughts about this?

Regards,
 Rifaat

On Wed, Aug 1, 2018 at 9:18 AM Yehoshua Gev <[email-masked]> wrote:

> Hi,
>
> After some thoughts about how the various sections of draft are intended
> to be used, I think you should consider splitting it to two drafts.
>
>    Possibly, the UA uses a novel (not defined by the OAuth RFCs)
> shared-key mechanism for "remaining authenticated" with the SIP Proxy.
> 2. Section 3 is intended for a UA which has means of obtaining OAuth
> access token (e.g., web application).

---

From: "A. Jean Mahoney" <[email-masked]>
Date: Thu, 2 Aug 2018 22:12:43 -0500

On 8/2/18 1:40 PM, Rifaat Shekh-Yusef wrote:
> *
> *

I'm not opposed to splitting the draft in two, but I would like to hear 
from the WG on it.

Thanks,

Jean

> Regards,
>   Rifaat
> 
> 
> 
> On Wed, Aug 1, 2018 at 9:18 AM Yehoshua Gev <[email-masked] 
> <mailto:[email-masked]>> wrote:
> 
>     Hi,
> 
>     After some thoughts about how the various sections of draft are
>     intended to be used, I think you should consider splitting it to two
>     drafts.
> 
>     1. Section 2 is intended for a UA as a way to perform login by
>     entering some sort of credentials.
>         After entering the credential, the SIP Proxy maintains a state
>     for "remaining authenticated" with the Authorization Server.
>         Part of the mechanism described in this section is similar to
>     steps A & B of section 4 of RFC 6749 (OAuth).
> 
>         This section describes a how to convey this access token over
>     SIP messages.
>         It is almost completely equivalent to RFC 6750 (OAuth Bearer
>     token) which does the same for HTTP.
> 
>     a. A UA will most probably implement only one of those mechanisms
>     and not both.
>         (To say a UA/Proxy conforms to the draft - must both mechanisms
>     be implemented?)
> _______________________________________________
> sipcore mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sipcore
>

---

From: "A. Jean Mahoney" <[email-masked]>
Date: Mon, 20 Aug 2018 17:08:36 -0500

Does anyone have any thoughts on this proposal?

Thanks!

Jean

On 8/2/18 10:12 PM, A. Jean Mahoney wrote:
>> I tend to agree with you, and I would be ok with splitting the 
>> document into two.

---

From: [email-masked] (Dale R. Worley)
Date: Sun, 26 Aug 2018 17:06:06 -0400

>>>     intended to be used, I think you should consider splitting it to two

I think splitting the draft would be useful.  As someone who knows
little about OAuth, I find the current draft difficult to comprehend.  I
think it would be easier to understand the draft (and critique it and
improve it) if the two mechanisms were described independently.  And I
think the many other people in the SIP community who know little about
OAuth would benefit in the same way.

Dale

---

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Wed, 29 Aug 2018 11:12:51 -0400

Thanks Dale!

Anybody objects to this proposal?

Regards,
 Rifaat