Subject: RE: [SIP] Problems with multi-proxy authentication

From: Robert Sparks <[email-masked]>
Date: Thu, 31 May 2001 14:37:46 -0400

> From: Christian Jansson [mailto:[email-masked]]
> But the main question is still that an UAC that re-sends a request
> after receiving a 407 can get a 401 back, which MUST have a
> WWW-Authenticate header. I thougth this 401/WWW-Authenticate response
> would mean the UAC was beeing queried for authentication by an UAS
> (not Proxy) and that the next request should have a Authorization
> header added to it. But all I wanted from the beginning was to get
> through a proxy...

If you got a 401, you got through. The Proxy-Authorization worked. The 
401 had to have come from something on the other side of the proxy.
Your next request would have _both_ a Proxy-Authorization header (to
get back through the proxy) and an Authorization header destined for
the thing that sent the 401.

> 
> 19.1, 3:rd sentence also seems to indicate that a proxy server isn't
> allowed to send 401s:
> "The 401 response is used by user agent servers in SIP to challenge
> the authorization of a user agent client. Additionally, registrars and
> redirect servers MAY make use of 401 responses for authorization, but
> proxies MUST NOT, and instead MAY use the 407 response."

This says a proxy won't _generate_ a 401, but doesn't prevent it
from forwarding one.

> 
> 
> Shouldn´t the proxy just send another 407 with Proxy-Authenticate if
> the credentials were wrong? Then the UAC would know that it is a
> Proxy-Authorization header it should provide in the next request.

That is exactly the expected behavior.

btw - if you didn't keep a copy of the original multiproxy-auth draft,
its still lingering at
http://www.softarmor.com/sipwg/drafts/draft-sparks-sip-multiproxy-auth-00.tx
t

RjS

_______________________________________________
This list is for continuing development of the SIP protocol.
The sip-implementor's list is the place to discuss implementation,
and to receive advice on understanding existing sip.
To subscribe to it, send mail to 
[email-masked] with "subscribe" in the body.

---

From: Christian Jansson <[email-masked]>
Date: Fri, 01 Jun 2001 00:08:00 +0100

Ok, it seems like we both agree on this. But take a look at 10.31 in
bis-03, last sentence. I think it trying to say that if I send the
wrong credentials to a 407/Proxy-Authentication I will get a 401 back!

Christian Jansson
Hotsip
www.hotsip.com

> btw - if you didn't keep a copy of the original multiproxy-auth
draft,
http://www.softarmor.com/sipwg/drafts/draft-sparks-sip-multiproxy-auth
-00.tx