Subject: [Gen-art] Genart last call review of draft-ietf-sipcore-sip-token-authnz-12

From: Linda Dunbar via Datatracker <[email-masked]>
Date: Mon, 13 Apr 2020 17:27:35 -0700

Reviewer: Linda Dunbar
Review result: Ready with Nits

I am the assigned Gen-ART reviewer for this draft. The General Area
Review Team (Gen-ART) reviews all IETF documents being processed
by the IESG for the IETF Chair.  Please treat these comments just
like any other last call comments.

For more information, please see the FAQ at

<https://trac.ietf.org/trac/gen/wiki/GenArtfaq>.

Document: draft-ietf-sipcore-sip-token-authnz-12
Reviewer: Linda Dunbar
Review Date: 2020-04-13
IETF LC End Date: 2020-04-15
IESG Telechat date: Not scheduled for a telechat

Summary:
  This document describes the scheme for SIP User Agent Client to get
  authentication from the Authentication Server. The scheme is straightforward
  and intuitive.

Major issues: None

Minor issues: None

Nits/editorial comments:

Some editorial issues:
Section 1.4.1: the first paragraph is very confusing. The steps after the
figure is much clear on what to be done. It is better to delete the the
sub-phrase "... where the registrar informs the UAC about the authorization ...
". The actual step is actually the UAC sends the request to Registrar and get
the response .. as described in the steps after the Figure.

Section 2.1.2 the paragraph before the last one (Page 8), I can' parse the
sentence. What do you want to say?

"If the UAC receives a 401/407 response with multiple WWWAuthenticate/
Proxy-Authenticate header fields, providing challenges
using different authentication schemes for the same realm, the UAC
provides credentials for one or more of the schemes that it supports,
based on local policy."

Section 2.1.3: What is AOR?

cheers,
Linda Dunbar

---

From: Christer Holmberg <[email-masked]>
Date: Tue, 14 Apr 2020 14:24:49 +0000

Hi Linda,

Thank You for the review! Please see inline.

>    the response .. as described in the steps after the Figure.
  
The purpose of the first sentence is to highlight the difference between 1.4.1 and 1.4.2: In 1.4.1 we describe the case where Registrars informs the UAC about the AS, while in 1.4.2 we describe the case where the AS is preconfigured in the UAC.

However, I do agree that the sentence is very long and confusing. Perhaps we could remove the "in a 401 response to the REGISTER request" part? 

---

>    sentence. What do you want to say?

I assume you mean Section 2.1.1?

>    provides credentials for one or more of the schemes that it supports,
  
We want to say that, if the UAC receives multiple challenges, with different authentication  schemes, for the same realm, the UAC picks one (and provides credentials) based on local policy.

Would it be more clear if we said something like:

"....for the same realm, the UAC selects one or more of the provided schemes (based on local policy) and provides credentials for those schemes."

---
  
>    Section 2.1.3: What is AOR?

Address-of-Record.

We will enhance the abbreviation, and add a reference to RFC 3261.

---

Regards,

Christer

---

From: Linda Dunbar <[email-masked]>
Date: Tue, 14 Apr 2020 18:41:48 +0000

Christer, 

Thank you for the quick response. Your updated wording are much more clear. 

Linda

-----Original Message-----
From: Christer Holmberg <[email-masked]> 
Sent: Tuesday, April 14, 2020 9:25 AM
To: Linda Dunbar <[email-masked]>; [email-masked]
Subject: Re: [Gen-art] Genart last call review of draft-ietf-sipcore-sip-token-authnz-12

Hi Linda,

  

---

  

---

Address-of-Record.

---

Regards,

Christer

---

From: Alissa Cooper <[email-masked]>
Date: Thu, 23 Apr 2020 16:52:28 -0400

Linda, thanks for your review. Christer, thanks for your response. I entered a No Objection ballot.

Alissa

> On Apr 14, 2020, at 2:41 PM, Linda Dunbar <[email-masked]> wrote:
> 
> Christer, 
> 
> _______________________________________________
> Gen-art mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/gen-art