Subject: RE: Replacing the QAUTH concept (was [Simple] SIMPLE BoF agenda)

From: Jonathan Rosenberg <[email-masked]>
Date: Mon, 19 Mar 2001 22:05:03 -0500

> -----Original Message-----
> From: Henning Schulzrinne [mailto:[email-masked]]
> Sent: Monday, March 19, 2001 1:42 PM
> To: Jonathan Rosenberg
> Cc: James Undery; Christian Huitema; [email-masked]
> Subject: Re: Replacing the QAUTH concept (was [Simple] SIMPLE BoF
> agenda)
> 
> 
> > 
> > 2. authentication
> > 
> > Since http and sip share authentication mechanisms (for 
> basic and digest at
> > least), and these are probably stored in some backend 
> database in most
> > systems (or at least in a file on disk), seems like they 
> could be shared
> > across http and sip servers.
> 
> In practice, this is difficult, since many web servers use just plain
> passwd or similar files, while many SIP servers use some form of
> database (since the number of users tends to be much larger). 
> Thus, you
> will have to use a special-purpose, custom-written web server or be
> forced to use the Apache mechanism in your SIP server. Neither seems
> ideal, to put it mildly. (I have no ambition to re-write Apache, but
> it's current user database mechanism is not very suitable for SIP.)

I think most real web applications do client authorization using EJB or some
other backend database access ontop of a web application server, but I could
be wrong (i.e., they are not using http authentication mechanisms at all,
but rather form posts within an ssl connection). If that is the case, then
you would access the same password database for both http and sip. 

> > 
> > Another issue is the bulk transport issue, since these 
> policy languages
> > could be quite large. As such, http, or sip over tcp, seem 
> like more or less
> > a requirement.
> > 
> 
> If this is policy for pending subscriptions, this is likely 
> to be small.
> 

We need to work through what such policy looks like, and then see.

-Jonathan R.
---
Jonathan D. Rosenberg                       72 Eagle Rock Ave.
Chief Scientist                             First Floor
dynamicsoft                                 East Hanover, NJ 07936
[email-masked]                     FAX:   (973) 952-5050
http://www.cs.columbia.edu/~jdrosen         PHONE: (973) 952-5000
http://www.dynamicsoft.com

---

From: Henning Schulzrinne <[email-masked]>
Date: Mon, 19 Mar 2001 22:47:09 -0800

> I think most real web applications do client authorization using EJB or some

Those applications do not use HTTP authentication, so this is only
slightly comparable. If they do not use HTTP authentication, but web
forms instead, it's rather difficult to automate the whole process
without the user being aware that policy is being uploaded. Cookies
(with SSL) help, but still require a user interface interaction with the
password for first-time use.

> you would access the same password database for both http and sip.

As I said, not likely. If it's using a backend database (I doubt that
it's EJB in most cases, since most web pages seem to be .asp these
days...), you might be able to use the same backend, assuming you don't
mind storing plaintext passwords.