Subject: RE: Replacing the QAUTH concept (was [Simple] SIMPLE BoF agenda)

From: "Christian Huitema" <[email-masked]>
Date: Thu, 15 Mar 2001 08:33:34 -0800

Bottom line, whatever programming you do in the server, there has to be
an escape clause that say "well, can't tell in general whether I want to
accept or block this <range of users>, so ask me before you publish
anything!" This is when you need something like QAUTH -- and since we
have QAUTH, we may as well keep it. Indeed, this begs the question of
what to do when the user is offline -- the simple solution is to not
provide information until the user had a chance to approve or disapprove
the subscription.

> -----Original Message-----
> From: Ben Campbell [mailto:[email-masked]]
> Sent: Thursday, March 15, 2001 6:37 AM
> To: 'James Undery'; Robert Sparks
> Cc: Christian Huitema; [email-masked]'
> Subject: RE: Replacing the QAUTH concept (was [Simple] SIMPLE BoF
agenda)
> 
> > I am all for a CPL style language to control generic sip
> > event subscriptions
> > and also agree this should be done outside the SIMPLE WG.
> >
> 
> First off, I do like the elegance of a CPL style mechanism plus a
> subscription to the list-of-subscribers as opposed to QAUTH, at least
as
> currently specificed. But their are two scenarios that make me a
little
> queasy. The first I think is fairly severe, the second is more of an
> inconvenience:
> 
> 1. X subscribes, and my rules allows the subscription. I am notified
that
> X
> has subscribed and realize that I do not want X to see my presence
state.
> I
> publish new rules to prevent X from re-subscribing. But it is too
late, X
> already has my presence information. Also, would the new rules apply
> immediately, or would X keep his subscription until it expires, and
merely
> be prohibited from re-subscribing?
> 
> 2. Y attempts to subscribe, but is rejected by my rules. If I knew
that Y
> wanted to subscribe I would allow it. But since I never get a
notification
> that Y wants to subscribe, I have no reason to update my rules.

---

From: James Undery <[email-masked]>
Date: Thu, 15 Mar 2001 16:46:42 +0000

Christian Huitema wrote:

> anything!"

You publish "The presentity is offline".

> This is when you need something like QAUTH -- and since we

If the presentity is really offline how does QUATH work? (CPIM is required
by this WGs charter so an immediate NOTIFY MUST be issued.)

Does the presentities PUA return 180 Asking until the user responds, what
happens if the request timesout waiting for the user, if it doesn't time out
how do you stop people DOSing the presence server?

James Undery