Subject: AW: AW: [AAA-WG]: questions/comments on draft-ietf-aaa-diameter-s ip-app-02

From: "Beck01, Wolfgang" <[email-masked]>
Date: Mon, 3 May 2004 13:15:23 +0200

Miguel,

you wrote:
> Yes, I think it is a MUST. All SIP requests contain a method name 
> (INVITE, REGISTER, etc.) and a Request-URI (the intended destination). 
> So there is no problem in the Diameter client inserting this 
> information.
To stretch your argument: Why stop here? Wouldn't it be useful to
include the whole SIP message? Then, the DIAMETER server could
even take SDP into account and restrict the use of certain codecs.
Of course, then either the DIAMETER server must be able to parse SIP
messages or we must replicate any SIP header with a corresponding 
AVP.

> Consequently, I wouldn't dare to start thinking of future 
> authentication mechanisms when we don't even have full support for 
> current mechanisms.
> 
> But if you have some clear requirement or scenario in your mind, please 
> let us know it.
Forget my comment. I was just wondering why you made the request target
mandatory and did not mention other headers, like the request origin.

Wolfgang

---

From: Miguel Garcia <[email-masked]>
Date: Mon, 03 May 2004 17:31:49 +0300

> messages or we must replicate any SIP header with a corresponding 

Yes, I see your point, but as you may understand, there might be a 
stopping point.

Perhaps the stoppint point is that the SIP Method and the Request-URI 
are needed to compute what HTTP Digest calls "A2" (see Section 3.2.2.3 
in RFC 2617). A2 is neeeded to compute request-digest (i.e., the 
response the client sends). So if authentication is done at the Diameter 
server, then it needs to get the SIP method and the Request-URI, even 
when those parameters are not used for authorization purposes.

Regards,

    - Miguel
-- 
Miguel A. Garcia           tel:+358-50-4804586
Nokia Research Center      Helsinki, Finland