Subject: Re: [sipcore] [Gen-art] Genart last call review of draft-ietf-sipcore-sip-token-authnz-12

From: Alissa Cooper <[email-masked]>
Date: Thu, 23 Apr 2020 16:52:28 -0400

Linda, thanks for your review. Christer, thanks for your response. I entered a No Objection ballot.

Alissa

> On Apr 14, 2020, at 2:41 PM, Linda Dunbar <[email-masked]> wrote:
> 
> Christer, 
> 
> Thank you for the quick response. Your updated wording are much more clear. 
> 
> Linda
> 
> -----Original Message-----
> From: Christer Holmberg <[email-masked]> 
> Sent: Tuesday, April 14, 2020 9:25 AM
> To: Linda Dunbar <[email-masked]>; [email-masked]
> Subject: Re: [Gen-art] Genart last call review of draft-ietf-sipcore-sip-token-authnz-12
> 
> Hi Linda,
> 
> Thank You for the review! Please see inline.
> 
>>   Section 1.4.1: the first paragraph is very confusing. The steps after the
>>   figure is much clear on what to be done. It is better to delete the the
>>   sub-phrase "... where the registrar informs the UAC about the authorization ...
>>   ". The actual step is actually the UAC sends the request to Registrar and get
>>   the response .. as described in the steps after the Figure.
> 
> The purpose of the first sentence is to highlight the difference between 1.4.1 and 1.4.2: In 1.4.1 we describe the case where Registrars informs the UAC about the AS, while in 1.4.2 we describe the case where the AS is preconfigured in the UAC.
> 
> However, I do agree that the sentence is very long and confusing. Perhaps we could remove the "in a 401 response to the REGISTER request" part? 
> 
> ---
> 
>>   Section 2.1.2 the paragraph before the last one (Page 8), I can' parse the
>>   sentence. What do you want to say?
> 
> I assume you mean Section 2.1.1?
> 
>>   "If the UAC receives a 401/407 response with multiple WWWAuthenticate/
>>   Proxy-Authenticate header fields, providing challenges
>>   using different authentication schemes for the same realm, the UAC
>>   provides credentials for one or more of the schemes that it supports,
>>   based on local policy."
> 
> We want to say that, if the UAC receives multiple challenges, with different authentication  schemes, for the same realm, the UAC picks one (and provides credentials) based on local policy.
> 
> Would it be more clear if we said something like:
> 
> "....for the same realm, the UAC selects one or more of the provided schemes (based on local policy) and provides credentials for those schemes."
> 
> ---
> 
>>   Section 2.1.3: What is AOR?
> 
> Address-of-Record.
> 
> We will enhance the abbreviation, and add a reference to RFC 3261.
> 
> ---
> 
> Regards,
> 
> Christer
> 
> 
> 
> _______________________________________________
> Gen-art mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/gen-art