Subject: RE: [Simple] authorization for presence

From: Jonathan Rosenberg <[email-masked]>
Date: Wed, 13 Jun 2001 01:44:51 -0400

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]
> Sent: Tuesday, June 12, 2001 12:11 PM
> To: 'Robert Brown'; Theodore Havinis; Jonathan Rosenberg;
> [email-masked]; 'Francois-Frederic Ozog'
> Subject: RE: [Simple] authorization for presence
> 
> 
> Some recent posts have made it clear that the subpackage proposal
> may be widely misunderstood. I'll attempt to clarify a couple 
> of points.
> 
> > NOTIFY sip:[email-masked] SIP/2.0
> > From: sip:bar.com
> > To: sip:[email-masked]
> > Event: watcherinfo
> > Cseq: 34
> 
> ...
> 
> "Event: watcherinfo" will **NEVER** be a valid thing to say. We are
> proposing this to be a *subpackage*, which means it must be contained
> in another package. For the purposes of the discussions we've been
> having here, my guess is that you mean to say "Event: 
> presence.watcherinfo"

Right. A notification for a watcherinfo event to my presence would have the
Event name of presence.watcherinfo. Such a notification would occur when
someone asked to subscribe to my presence.

> 
> One of the consequences of this fact is that, for example, including
> "event" as part of the XML document makes no sense.
> 
> ><authlist>
> >   <subscriber URI="sip:[email-masked]" event="presence" 
> auth="allow" />
> >   <subscriber URI="sip:[email-masked]" 
> attribute="geolocation" auth="allow"
> />
> >   <subscriber URI="sip:[email-masked]" event="presence" 
> auth="block" />
> ></authlist>
> 
> Since this document will be carried in a NOTIFY which has an
> "Event:" header of "presence.watcherinfo," 

Well, thats the question. My interpretation of this document above is that
its the thing thats carried in the AUTH (or whatever we defined) method that
sets authorization policy. You are correct that the document carried in a
NOTIFY of presence.watcherinfo has no need to define the event. But, the
document carried in the AUTH does need to define it.

-Jonathan R.
---
Jonathan D. Rosenberg, Ph.D.                72 Eagle Rock Ave.
Chief Scientist                             First Floor
dynamicsoft                                 East Hanover, NJ 07936
[email-masked]                     FAX:   (973) 952-5050
http://www.jdrosen.net                      PHONE: (973) 952-5000
http://www.dynamicsoft.com

---

From: "Francois-Frederic Ozog" <[email-masked]>
Date: Thu, 14 Jun 2001 09:20:04 +0200

What about using the MESSAGE method to carry the authorization document ?

Content-Type header would be set to: message/presence-authorization or
whatever works like application/simple-authorization...

----- Original Message -----
From: "Jonathan Rosenberg" <[email-masked]>
To: <[email-masked]>; "'Robert Brown'" <[email-masked]>;
"Theodore Havinis" <[email-masked]>; "Jonathan Rosenberg"
<[email-masked]>; <[email-masked]>;
"'Francois-Frederic Ozog'" <[email-masked]>
Sent: Wednesday, June 13, 2001 7:44 AM
Subject: RE: [Simple] authorization for presence

> http://www.dynamicsoft.com

______________________________________________________________________________
ifrance.com, l'email gratuit le plus complet de l'Internet !
vos emails depuis un navigateur, en POP3, sur Minitel, sur le WAP...
http://www.ifrance.com/_reloc/email.emailif

---

From: [email-masked]
Date: Thu, 14 Jun 2001 11:45:49 -0500

MESSAGE has render semantics associated with it. It means, "the
body of this request contains data that is to be rendered in
a reasonable manner for the human to whom I have addressed it."

What you have suggested is a wildly different application, which
generally means that you should create a new method for it.

This is widely overlooked: methods actually *mean* something.

If all behavior were based on content-type and content-disposition,
we could have saved ourselves a *lot* of trouble by defining a
transport for sending raw MIME bodies on the wire, and called
ourselves done.

/a

> From: Francois-Frederic Ozog [mailto:[email-masked]]
> Sent: Thursday, June 14, 2001 2:20 AM
> To: Jonathan Rosenberg; [email-masked]; 'Robert Brown';
> Theodore Havinis
> Cc: [email-masked]
> Subject: Re: [Simple] authorization for presence
> 
> 
> > Right. A notification for a watcherinfo event to my 
> presence would have
> the
> > its the thing thats carried in the AUTH (or whatever we 
> defined) method
> that

---

From: "Francois-Frederic Ozog" <[email-masked]>
Date: Thu, 14 Jun 2001 19:45:56 +0200

It makes sense.
I just had the feeling that we may encounter other circumstances where a PUA
or a PS has to send "documents", not commands.

Now, if we do not need such method, AUTH seems pretty adequate, providing
that the content can be flexible. For instance, we define authorization
document version 1, after a few years we refine it with version 2. Or two
ways of specifying authorization may cohexist: CPL, CGI... And I still do
not like HTTP method as it looses the SIP proxying mechanism: PUA must then
resolve a PS SIP address down to a non-proxied URL.

----- Original Message -----
From: <[email-masked]>
To: "'Francois-Frederic Ozog'" <[email-masked]>; "Jonathan Rosenberg"
<[email-masked]>; <[email-masked]>; "'Robert Brown'"
<[email-masked]>; "Theodore Havinis" <[email-masked]>
Cc: <[email-masked]>
Sent: Thursday, June 14, 2001 6:45 PM
Subject: RE: [Simple] authorization for presence