Subject: [Wish] WHIP and authentication

From: Juliusz Chroboczek <[email-masked]>
Date: Sat, 11 Sep 2021 13:22:49 +0200

Section draft-ietf-wish-whip-00 Section 4.5 speaks about authentication:

   Authentication and authorization is supported by the Authorization
   HTTP header with a bearer token as per [RFC6750].

To my unexperienced eyes, this implies that use of WHIP requires deploying
an OAuth2 infrastructure, with all of the complexity and brittleness that
this implies.  Galene doesn't do OAuth2, and, in the Galene implementation,
WHIP is authentified using HTTP Basic over HTTPS.

How do people feel about use of HTTP Basic with WHIP?

-- Juliusz

---

From: Sergio Garcia Murillo <[email-masked]>
Date: Sat, 11 Sep 2021 14:52:50 +0200

> How do people feel about use of HTTP Basic with WHIP?

No, at least the idea was not to require oauth/2 for retrieving the bearer
token, rfc 6750 is just referenced about how to create the request header
carrying the token. How to generate/gather the bearer token is outside the
scope of the doc. This how most rest APIs work nowadays.

In this regards, basic auth provides no flexibility over the bearer token,
asyou can always use "username:password" or whatever you choose as token.
Or better, use an encrypted/ authenticated jwt for carrying that info.

Best regards
Sergio.

---

From: Juliusz Chroboczek <[email-masked]>
Date: Sat, 11 Sep 2021 15:31:51 +0200

https://github.com/wish-wg/webrtc-http-ingest-protocol/issues/16