Subject: AW: AW: AW: [AAA-WG]: questions/comments on draft-ietf-aaa-diamet er-s ip-app-02

From: "Beck01, Wolfgang" <[email-masked]>
Date: Tue, 4 May 2004 09:06:53 +0200

Miguel,

> Perhaps the stopping point is that the SIP Method and the Request-URI 
> are needed to compute what HTTP Digest calls "A2" (see Section 3.2.2.3 
> in RFC 2617). A2 is neeeded to compute request-digest (i.e., the 
> response the client sends). So if authentication is done at the Diameter 
> server, then it needs to get the SIP method and the Request-URI, even 
> when those parameters are not used for authorization purposes.
The are two MAR/MAA exchanges. In the first exchange, SIP Method and
Request-URI are not required. The DIAMETER server just chooses some
random values (nonce, opaque) and does not decide whether to allow or
deny the request. Sending SIP Method and Request-URI here seems to be
a waste of bandwidth.

In the second exchange, SIP Method and Request-URI are indeed mandatory.
So, I would make SIP Method and Request-URI a MUST only in the case
where the DIAMETER server makes a authentication decision.

Wolfgang

---

From: Miguel Garcia <[email-masked]>
Date: Tue, 04 May 2004 10:33:50 +0300

> where the DIAMETER server makes a authentication decision.

I agree with the fact that the SIP method and the SIP AOR are not needed 
in the first MAR/MAA exchange for the purpose of generating the 
challenge. However, it may be needed for the purpose of authorization. 
As I said before, a network may implement a policy of not authorizing 
certain SIP requests destined to certain networks. So the Diameter 
server will not even come into the authentication procedure, because 
authorization was denied. In that case I found valuable the SIP server 
providing the SIP method and SIP AOR to the Diameter server.

On the other hand, I also find easier to implement a command that always 
insert an AVP, rather than taking the decision when to send the AVP, 
when not. Then we need to provide further procedures at the Diameter 
server to verify that those AVPs are present when they need to present.

I don't agree with you with the bandwidth argument. I think the SIP 
method and the Request-URI can be encoded typically in 30 bytes (I am 
exagerating).

My suggestion is to leave these AVPs as mandatory as they currently are.

- Miguel
-- 
Miguel A. Garcia           tel:+358-50-4804586
Nokia Research Center      Helsinki, Finland