Subject: RE: Replacing the QAUTH concept (was [Simple] SIMPLE BoF agenda)

From: Jonathan Rosenberg <[email-masked]>
Date: Thu, 15 Mar 2001 15:15:58 -0500

> -----Original Message-----
> From: Henning G. Schulzrinne [mailto:[email-masked]]
> Sent: Thursday, March 15, 2001 12:54 PM
> To: Jonathan Rosenberg
> Cc: 'James Undery'; Christian Huitema; [email-masked]
> Subject: Re: Replacing the QAUTH concept (was [Simple] SIMPLE BoF
> agenda)
> 
> 
> If we use something like CPL, this would in all likelihood be uploaded
> as part of the generic request handling mechanism. (This 
> makes sense, I
> believe, since in many cases, the filtering rules are similar. If I
> don't want to hear from user X, I probably don't want to have him
> subscribe to me, either. The converse isn't true, obviously.)
> 
> Thus, one such mechanism could be REGISTER.
> 
> It would indeed be nice if we could agree on one mechanism, 
> as otherwise
> a crucial piece will be missing and be different for every single
> service provider. Just relying on form + HTTP is, in my opinion, a bad
> idea, as it doesn't work well with devices with limited screen
> resolution. 

I agree. I wasn't advocating forms for everything. I was advocating
something like http+CPLng. REGISTER is also a possibility, although I think
http is more appropriate.

I think its just fine to have more than one policy mechanism. After all, its
a key concept in sip that things like policy, routing, AAA and location
service are orthogonal to sip itself. All I am advocating is the same; lets
keep the authorization mechanisms totally orthogonal, and allow there to be
more than one. I see no reason why forms couldn't be used, nor why a
DIAMETER dip into a back end enterprise wide policy server couldn't be used.

So, I think we do need to standardize some kind of simple policy mechanism,
ala CPL. Where it gets done is a good question. One might argue that its in
scope here, or perhaps in iptel. Some of the other presence protocols
include authorization within the protocol. Whilst I think thats a bad idea,
its precedent that treatment of authorization is within the scope of the
group doing that presence protocol.

Any inputs from our ADs on this one?

-Jonathan R.

---
Jonathan D. Rosenberg                       72 Eagle Rock Ave.
Chief Scientist                             First Floor
dynamicsoft                                 East Hanover, NJ 07936
[email-masked]                     FAX:   (973) 952-5050
http://www.cs.columbia.edu/~jdrosen         PHONE: (973) 952-5000
http://www.dynamicsoft.com

---

From: James Undery <[email-masked]>
Date: Fri, 16 Mar 2001 09:20:05 +0000

> http is more appropriate.

I agree with Jonathan here, I really don't like using REGISTER to upload CPL
scripts as it allows the REGISTER to do two independent things either of which
could fail, firstly update location information (could fail with 409) and
secondly store a script which could be illegal. Reporting these two separate
results in a single response is ugly.

> group doing that presence protocol.

I think any simple/SIMPLE policy mechanism has to be done in conjunction with
the Sun/Not work Adam is doing in sip-events.

James Undery

---

From: "Henning G. Schulzrinne" <[email-masked]>
Date: Fri, 16 Mar 2001 09:38:15 -0500

James Undery wrote:

> results in a single response is ugly.

Whether this is done via REGISTER or a new method (which may well be
preferable), using SIP hasa the advantage that the addressing and
authentication is consistent and that the number of protocols that need
to be supported stays finite.

-- 
Henning Schulzrinne   http://www.cs.columbia.edu/~hgs