Subject: [Simple] Somes questions about behavior of PS

From: "Tang Lihua" <[email-masked]>
Date: Wed, 23 Jan 2002 11:52:29 +0800

Hi,guys

I want to clarify the behaviour of PS. My questions are as follows: 

About Registrar
1. How to upload buddylist or watcherlist to PS? Through registration or 
other way? If a buddylist is stored in PS, should PS automaticly send out 
subscription to each buddy on the list? And it's strange that in this case 
a watcher will receive notifications but no subscription is sent out by the 
watcher itself. Also another problem is that it will burden PS with 
handling all the buddylists or watcherlists. 
2. If a user gets unregistered, remove this user from database or just mark 
it as 'Unregistered'?
How can the PS know an offline presentity is a once registered user? Is 
User Managerment a need? 
 
About Authentication
1. Is the authentication in PS a server-side(as proxy) or a ua-side one(as 
PA) one? If a subscription is sent to an offline presentity, should the PS 
challenge the subscriber?
2. Should the PS maintain access password lists of each presentity for each 
possible watcher? Is there a better way for PS to authorize the watcher?
2. Draft says, 'For pending subscriptions, the state of the presentity 
SHOULD include some kind of textual note that indicates a pending status.' 
Is there any solution to it till now? More, how can the PS notify the 
watcher that a buddy is offline now or a buddy gets online?

Thanks for your comments!

Best regards,

Tang Lihua

_________________________________________________________________
享用世界上最大的 Web 电子邮件系统 ―― MSN Hotmail。
http://www.hotmail.com/cn

---

From: Jonathan Rosenberg <[email-masked]>
Date: Thu, 14 Feb 2002 02:37:15 -0500

Sorry for the delay in responding... other IETF activities have kept me
busy. Inline.

Tang Lihua wrote:
> 1. How to upload buddylist or watcherlist to PS?

There is no specified or mandatory way. Certainly a web page can be
used. There is some demand for a more automated way; this is a common
problem for many data elements that need to be managed. There is a
separate thread on that for the case of managing publication of presence
documents, where SOAP has been proposed.

> If a buddylist is stored in PS, should PS automaticly send
> out
> subscription to each buddy on the list? 

If the subscription is to the buddy list, yes, this is documented in:

http://search.ietf.org/internet-drafts/draft-rosenberg-simple-buddylist-package-00.txt

> And it's strange that in this
> case
> watcher itself.

Not really strange. See the above draft.

> Also another problem is that it will burden PS with

Its not mandatory to provide in a system, of course. A provider can
limit this however its policy dictates.

> How can the PS know an offline presentity is a once registered user? Is

Generally, the way a PS constructs a presence document is a matter of
policy, and it is a complex policy issue, involving the user, the
provider, and possibly third party policies. The presence document can
be based on registration status, but usually not solely based on it. 

Registration doesn't affect whether a user is a valid customer of the
service, of course. When you say "remove this user from the DB", that
makes no sense to me, since they are still a valid customer.

> PA) one? 

A PA is a type of SIP UA, and thus uses the user-user authentication. If
the PS is acting as a proxy, it would use proxy-user autehtnication.

Please note that SIMPLE authentication has gotten radically better in
the past month or so as a result of big improvements in overall sip
security mechanisms.

> If a subscription is sent to an offline presentity, should the
> PS

Generally, all subscriptions need to be authenticated. 

> possible watcher? Is there a better way for PS to authorize the watcher?

SIP provides several ways:

1. password lists provided by the presentity, as you mention. Doesn't
scale well, doesn't allow unknown subscribers. Good for some usages,
though.

2. S/MIME. New for sip, and works well for presence. It assumes client
certs, which is not awfully common, but OK.

3. transitivte trust. The new sips scheme works well here. 

So, we have solutions that run the gamut. This is a hard problem in
general, as its in the area of inter-domain authentication between
entities that may not know each other. 

> Is there any solution to it till now? 

Solution to what? The status is marked as "pending" or something.

> More, how can the PS notify the

A NOTIFY message. That is the point of the presence mechanism.

-Jonathan R.

-- 
Jonathan D. Rosenberg, Ph.D.            72 Eagle Rock Avenue
Chief Scientist                         First Floor
dynamicsoft                             East Hanover, NJ 07936
[email-masked]                 FAX: (973) 952-5050
http://www.jdrosen.net                  PH:  (973) 952-5000
http://www.dynamicsoft.com