Subject: [tram] Alissa Cooper's No Objection on draft-ietf-tram-turn-third-party-authz-12: (with COMMENT)

From: "Alissa Cooper" <[email-masked]>
Date: Wed, 18 Feb 2015 14:57:17 -0800

Alissa Cooper has entered the following ballot position for
draft-ietf-tram-turn-third-party-authz-12: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to http://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
http://datatracker.ietf.org/doc/draft-ietf-tram-turn-third-party-authz/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

= Section 4 =
Is it assumed that once a particular STUN server indicates support for
third party authorization, the client should include an OAuth token in
all future requests to that server? Or is the client expected to check
for support again at some point in the future by sending a request
without authorization? Just wondering if the case where a server enables
and later disables support for third party authz (for some operational
reason) is covered.

= Section 6.2 =
"the client MUST NOT examine the ticket"

I think you meant token, not ticket.

---

From: "Tirumaleswar Reddy (tireddy)" <[email-masked]>
Date: Thu, 19 Feb 2015 06:26:12 +0000

> -----Original Message-----
> From: tram [mailto:[email-masked]] On Behalf Of Alissa Cooper
> Sent: Thursday, February 19, 2015 4:27 AM
> To: The IESG
> Cc: [email-masked]; [email-masked];
> Gonzalo Camarillo
> Subject: [tram] Alissa Cooper's No Objection on draft-ietf-tram-turn-third-
> party-authz-12: (with COMMENT)
> 
> When responding, please keep the subject line intact and reply to all email
> addresses included in the To and CC lines. (Feel free to cut this introductory
> paragraph, however.)
> 
> 
> Is it assumed that once a particular STUN server indicates support for third
> party authorization, the client should include an OAuth token in all future
> requests to that server? 

No.

> Or is the client expected to check for support again
> at some point in the future by sending a request without authorization? 

Yes, the client for subsequent Allocate requests has to first check if the server supports third party authorization or not.

> Just
> wondering if the case where a server enables and later disables support for
> third party authz (for some operational
> reason) is covered.
> 
> = Section 6.2 =

Yes, fixed.

-Tiru

> 
> 
> _______________________________________________
> tram mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tram