Subject: [SIP] Problems with multi-proxy authentication

From: [email-masked]
Date: Wed, 30 May 2001 18:24:50 +0530

Hi,

The call-flows draft shows a multi-proxy authentication scenario where a
client sends two Proxy-Authorization headers in a request message. The
Proxy-Authorization header grammar doesn't provide for multiple
Proxy-Authorization header instances in a message. Perhaps this grammar
needs to be defined differently for SIP instead of referring to the syntax
in the HTTP draft.

The other issue is regarding proxies optionally consuming or relaying the
credentials in a message. Wouldn't this add to the complexity of proxy
implementations for figuring out when to consume and when to leave it alone
? Wouldn't it be simpler if proxies never consumed the proxy-authorization
header and proxies expecting credentials tried out the entire list of
Proxy-Authorization headers for a match ? Also the draft currently does not
seem to specify if proxies should only check the topmost
Proxy-Authorization header if they are expecting a response to a challenge.

-Binu

_______________________________________________
This list is for continuing development of the SIP protocol.
The sip-implementor's list is the place to discuss implementation,
and to receive advice on understanding existing sip.
To subscribe to it, send mail to 
[email-masked] with "subscribe" in the body.

---

From: "Christian Jansson" <[email-masked]>
Date: Wed, 30 May 2001 17:05:17 +0200

Some questions on the multi-proxy authentication scenario from
draft-ietf-sip-call-flows-03.txt:

How should the UAC figure out that the second 407 is from another server
than the first 407 came from, and not that the credentials sent to Proxy1
were wrong? In both cases the UAC sends the INVITE with the same
Request-URI I assume, and because the realm could be any text string,
both servers could have realm="SIP-Proxy". So what is the significant
difference that makes the UAC add two Proxy-Authorization headers
to the INVITE.

Another question is about the description of Proxy-Authenticate.The last
sentence states that: "The server responds with 401 (Unauthorized) if the
client guessed wrong". And the description for WWW-Authenticate states
that: "the WWW-Authenticate response-header MUST be included in 401".
But the handling of WWW-Authenticate seems to be totally different as it is
based on the To header while Proxy-Authenticate handling is based on the
Request-Uri. So how is a UAC supposed to handle this?

I also think that the description of Proxy-Authenticate is a bit strange as
it
talks a lot about the UAC "contacting a specific proxy server". Since when
did a SIP UAC actually know that it was going to contact a proxy server
and not a UAS, or a redirect server?

Christian Jansson
Hotsip
www.hotsip.com

---

From: Alan Johnston <[email-masked]>
Date: Thu, 31 May 2001 09:04:14 -0500

This call flow and the supporting text was based on the expired I-D by Robert
Sparks "Providing for Multiple-Proxy Authentication of a SIP Request"

http://www.softarmor.com/sipwg/drafts/draft-sparks-sip-multiproxy-auth-00.txt

The call flows draft is purely informational, not normative.  All normative
changes were to be included in bis to make this call flow work.

Thanks,
Alan Johnston
WorldCom
sip:[email-masked]