Subject: RE: [SIP] Problems with multi-proxy authentication

From: Jonathan Rosenberg <[email-masked]>
Date: Fri, 1 Jun 2001 03:44:24 -0400

> -----Original Message-----
> From: Robert Sparks [mailto:[email-masked]]
> Sent: Thursday, May 31, 2001 2:29 PM
> To: 'Christian Jansson'; Robert Sparks; [email-masked]'
> Cc: [email-masked]; [email-masked]
> Subject: RE: [SIP] Problems with multi-proxy authentication
> 
> 
> 
> 
> > -----Original Message-----
> > From: Christian Jansson [mailto:[email-masked]]
> > Sent: Thursday, May 31, 2001 2:24 PM
> > To: "Robert Sparks"
> > Cc: [email-masked]; [email-masked]
> > Subject: RE: [SIP] Problems with multi-proxy authentication
> > 
> > 
> > 
> > > > Another question is about the description of 
> > > > Proxy-Authenticate.The last
> > > > sentence states that: "The server responds with 401 
> > > > (Unauthorized) if the
> > > > client guessed wrong". And the description for WWW-Authenticate
> > > > states
> > > > that: "the WWW-Authenticate response-header MUST be included in 
> > > > 401".
> > > > But the handling of WWW-Authenticate seems to be totally 
> > > > different as it is
> > > > based on the To header while Proxy-Authenticate handling is 
> > > > based on the
> > > > Request-Uri. So how is a UAC supposed to handle this?
> > > 
> > > Where do you get the idea that WWW-Authenticate is based on a To:
> > > header?
> > 
> > I got it from 10.48 WWW-Authenticate (bis-03). The second 
> part states
> > that: "A user agent SHOULD cache the authorization credentials for a
> > given value of the destination (To header) and realm ...".
> 
> I'm not sure why that's there. It implies that I (the user) 
> will have to
> reenter my proxy credentials every time I call someone new. I 
> don't think
> that's what was intended. Jonathan?

No, it doesn't imply you will re-enter them. Remember, we are talking about
UAS authentication of a UAC. It has nothing to do with proxies. So, if you
call someone new, odds are that it will require new credentials. In fact,
using the request URI here would be wrong, since it might be different
between the initial INVITE and the ACK/re-INVITE/BYE because of Contact and
Record-Routing. However, the URL portion of the To field doesn't change
(I'll update the text to say URL portion, not just the whole To field).

Christian also wrote:
> Ok, it seems like we both agree on this. But take a look at 10.31 in
> bis-03, last sentence. I think it trying to say that if I send the
> wrong credentials to a 407/Proxy-Authentication I will get a 401 back!

Yikes... that seems wrong to me also, and would explain your confusion.
Henning?

Christian wrote:
> I also think that the description of Proxy-Authenticate is a 
> bit strange as
> it
> talks a lot about the UAC "contacting a specific proxy 
> server". Since when
> did a SIP UAC actually know that it was going to contact a 
> proxy server
> and not a UAS, or a redirect server?

Yes, I agree this is confusing. We need a concise definition of how to cache
credentials, if we want to provide support for that. I'm not really sure how
to do it, since its hard to say whether a specific request will reach a
specific proxy. The most important case, local outbound proxies, is easy,
since the UAC knows that every request goes to that. I'm not sure any other
proxy credential caching will be that useful. Maybe we should limit the
discussion to just that case?

-Jonathan R.
---
Jonathan D. Rosenberg, Ph.D.                72 Eagle Rock Ave.
Chief Scientist                             First Floor
dynamicsoft                                 East Hanover, NJ 07936
[email-masked]                     FAX:   (973) 952-5050
http://www.jdrosen.net                      PHONE: (973) 952-5000
http://www.dynamicsoft.com

_______________________________________________
This list is for continuing development of the SIP protocol.
The sip-implementor's list is the place to discuss implementation,
and to receive advice on understanding existing sip.
To subscribe to it, send mail to 
[email-masked] with "subscribe" in the body.

---

From: "Christian Jansson" <[email-masked]>
Date: Fri, 1 Jun 2001 14:30:19 +0200

> (I'll update the text to say URL portion, not just the whole To field).

10.48 in bis-03 also mentions the Request-URI three lines above the line
talking about the To header. This can be a bit confusing.

> > bit strange as  it talks a lot about the UAC "contacting a specific
> > proxy server". Since when did a SIP UAC actually know that it was
> > going to contact a proxy server and not a UAS, or a redirect server?
>

Yes the UAC knows that every request goes to the outbound proxy, but if
the UAC gets a 407, how can it detect that it is from the local outbound
proxy
and not from some other proxy in the chain?

I think local outbound proxy is the special case as every request,
independent
of request-uri, will pass through it and could be challenged for proxy
authentication.
This could really mess up the credential cache with one entry per every
request-uri,
even though we know that we probably could have used already cached
credentials.

Could we make use of the "domain" parameter as defined in 3.2.1
RFC2617HttpAuth
and instead cache credentials according to the domain provided in the
challenge? Then
if the address of the local outbound proxy matched one of the domains in the
cache we
could add the correct Proxy-Authorization header to every request without
having
the request-407 roundtrip. This would prevent the credentials cache from
having
an entry for each request-uri.

Christian Jansson
Hotsip
www.hotsip.com