idnits 2.17.1 draft-ietf-sipping-consent-format-07.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- ** It looks like you're using RFC 3978 boilerplate. You should update this to the boilerplate described in the IETF Trust License Policy document (see https://trustee.ietf.org/license-info), which is required now. -- Found old boilerplate from RFC 3978, Section 5.1 on line 15. -- Found old boilerplate from RFC 3978, Section 5.5, updated by RFC 4748 on line 592. -- Found old boilerplate from RFC 3979, Section 5, paragraph 1 on line 603. -- Found old boilerplate from RFC 3979, Section 5, paragraph 2 on line 610. -- Found old boilerplate from RFC 3979, Section 5, paragraph 3 on line 616. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- No issues found here. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust Copyright Line does not match the current year -- The document seems to lack a disclaimer for pre-RFC5378 work, but may have content which was first submitted before 10 November 2008. If you have contacted all the original authors and they are all willing to grant the BCP78 rights to the IETF Trust, then this is fine, and you can ignore this comment. If not, you may need to add the pre-RFC5378 disclaimer. (See the Legal Provisions document at https://trustee.ietf.org/license-info for more information.) -- The document date (May 29, 2008) is 5808 days in the past. Is this intentional? Checking references for intended status: Proposed Standard ---------------------------------------------------------------------------- (See RFCs 3967 and 4897 for information about using normative references to lower-maturity documents in RFCs) ** Obsolete normative reference: RFC 2617 (Obsoleted by RFC 7235, RFC 7615, RFC 7616, RFC 7617) ** Obsolete normative reference: RFC 4474 (Obsoleted by RFC 8224) Summary: 3 errors (**), 0 flaws (~~), 1 warning (==), 7 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 SIPPING G. Camarillo 3 Internet-Draft Ericsson 4 Intended status: Standards Track May 29, 2008 5 Expires: November 30, 2008 7 A Document Format for Requesting Consent 8 draft-ietf-sipping-consent-format-07.txt 10 Status of this Memo 12 By submitting this Internet-Draft, each author represents that any 13 applicable patent or other IPR claims of which he or she is aware 14 have been or will be disclosed, and any of which he or she becomes 15 aware will be disclosed, in accordance with Section 6 of BCP 79. 17 Internet-Drafts are working documents of the Internet Engineering 18 Task Force (IETF), its areas, and its working groups. Note that 19 other groups may also distribute working documents as Internet- 20 Drafts. 22 Internet-Drafts are draft documents valid for a maximum of six months 23 and may be updated, replaced, or obsoleted by other documents at any 24 time. It is inappropriate to use Internet-Drafts as reference 25 material or to cite them other than as "work in progress." 27 The list of current Internet-Drafts can be accessed at 28 http://www.ietf.org/ietf/1id-abstracts.txt. 30 The list of Internet-Draft Shadow Directories can be accessed at 31 http://www.ietf.org/shadow.html. 33 This Internet-Draft will expire on November 30, 2008. 35 Copyright Notice 37 Copyright (C) The IETF Trust (2008). 39 Abstract 41 This document defines an Extensible Markup Language (XML) format for 42 a permission document used to request consent. A permission document 43 written in this format is used by a relay to request a specific 44 recipient permission to perform a particular routing translation. 46 Table of Contents 48 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3 49 2. Definitions and Terminology . . . . . . . . . . . . . . . . . 3 50 3. Permission Document Structure . . . . . . . . . . . . . . . . 4 51 3.1. Conditions . . . . . . . . . . . . . . . . . . . . . . . . 4 52 3.1.1. Recipient Condition . . . . . . . . . . . . . . . . . 4 53 3.1.2. Identity Condition . . . . . . . . . . . . . . . . . . 5 54 3.1.3. Target Condition . . . . . . . . . . . . . . . . . . . 8 55 3.1.4. Validity Condition . . . . . . . . . . . . . . . . . . 8 56 3.1.5. Sphere Condition . . . . . . . . . . . . . . . . . . . 8 57 3.2. Actions . . . . . . . . . . . . . . . . . . . . . . . . . 8 58 3.2.1. Translation Handling . . . . . . . . . . . . . . . . . 8 59 4. Example Document . . . . . . . . . . . . . . . . . . . . . . . 9 60 5. XML Schema . . . . . . . . . . . . . . . . . . . . . . . . . . 10 61 6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 11 62 6.1. XML Namespace Registration . . . . . . . . . . . . . . . . 11 63 6.2. XML Schema Registration . . . . . . . . . . . . . . . . . 12 64 7. Security Considerations . . . . . . . . . . . . . . . . . . . 12 65 8. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 12 66 9. References . . . . . . . . . . . . . . . . . . . . . . . . . . 13 67 9.1. Normative References . . . . . . . . . . . . . . . . . . . 13 68 9.2. Informative References . . . . . . . . . . . . . . . . . . 13 69 Author's Address . . . . . . . . . . . . . . . . . . . . . . . . . 14 70 Intellectual Property and Copyright Statements . . . . . . . . . . 15 72 1. Introduction 74 The framework for consent-based communications in the Session 75 Initiation Protocol (SIP) [I-D.ietf-sip-consent-framework] identifies 76 the need for a format to create permission documents. Such 77 permission documents are used by SIP [RFC3261] relays to request 78 permission to perform translations. A relay is defined as any SIP 79 server, be it a proxy, B2BUA (Back-to-Back User Agent), or some 80 hybrid, which receives a request and translates the request URI into 81 one or more next hop URIs to which it then delivers a request. 83 The format for permission documents specified in this document is 84 based on Common Policy [RFC4745], an XML document format for 85 expressing privacy preferences. 87 2. Definitions and Terminology 89 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 90 "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this 91 document are to be interpreted as described in [RFC2119]. 93 This document uses the terms defined in 94 [I-D.ietf-sip-consent-framework]. For completeness, these terms are 95 repeated here. Figure 1 of [I-D.ietf-sip-consent-framework] shows 96 the relationship between target and recipient URIs in a translation 97 operation. 99 Recipient URI: 101 The Request-URI of an outgoing request sent by an entity (e.g., a 102 user agent or a proxy). The sending of such request can have been 103 the result of a translation operation. 105 Relay: 107 Any SIP server, be it a proxy, B2BUA (Back-to-Back User Agent), or 108 some hybrid, that receives a request, translates its Request-URI 109 into one or more next-hop URIs (i.e., recipient URIs), and 110 delivers the request to those URIs. 112 Target URI: 114 The Request-URI of an incoming request that arrives to a relay 115 that will perform a translation operation. 117 Translation logic: 119 The logic that defines a translation operation at a relay. This 120 logic includes the translation's target and recipient URIs. 122 Translation operation: 124 Operation by which a relay translates the Request-URI of an 125 incoming request (i.e., the target URI) into one or more URIs 126 (i.e., recipient URIs) which are used as the Request- URIs of one 127 or more outgoing requests. 129 3. Permission Document Structure 131 A permission document is an XML document, formatted according to the 132 schema defined in [RFC4745]. Permission documents inherit the MIME 133 type of common policy documents, 'application/auth-policy+xml'. As 134 described in [RFC4745], this type of document is composed of three 135 parts: conditions, actions, and transformations. 137 This section defines the new conditions and actions defined by this 138 specification. This specification does not define any new 139 transformation. 141 3.1. Conditions 143 The conditions in a permission document are a set of expressions, 144 each of which evaluates to either TRUE or FALSE. Note that, as 145 discussed in [RFC4745], a permission document applies to a 146 translation if all the expressions in its conditions part evaluate to 147 TRUE. 149 3.1.1. Recipient Condition 151 The recipient condition is matched against the recipient URI of a 152 translation. Recipient conditions can contain the same elements and 153 attributes as identity conditions. 155 When performing a translation, a relay matches the recipient 156 condition of the permission document that was used to request 157 permission for that translation against the destination URI of the 158 outgoing request. When receiving a request granting or denying 159 permissions (e.g., a SIP PUBLISH request as described in 160 [I-D.ietf-sip-consent-framework]), the relay matches the recipient 161 condition of the permission document that was used to request 162 permission against the identity of the entity granting or denying 163 permissions (i.e., the sender of the PUBLISH request). If there is a 164 match, the recipient condition evaluates to TRUE. Otherwise, the 165 recipient condition evaluates to FALSE. 167 Since only authenticated identities can be matched, this section 168 defines acceptable means of authentication, which are in line with 169 those described in Section 5.6.1 of [I-D.ietf-sip-consent-framework]. 171 The 'id' attribute in the elements and MUST contain a 172 scheme when these elements appear in a permission document. 174 When used with SIP, a recipient granting or denying a relay 175 permissions is considered authenticated if one of the following 176 techniques is used: 178 SIP Identity [RFC4474], as described in Section 5.6.1.1 of 179 [I-D.ietf-sip-consent-framework]. For PUBLISH requests that are 180 authenticated using the SIP Identity mechanism, the identity of 181 the sender of the PUBLISH request is equal to the SIP URI in the 182 From header field of the request, assuming that the signature in 183 the Identity header field has been validated. 185 P-Asserted-Identity [RFC3325] (which can only be used in closed 186 network environments) as described in Section 5.6.1.2 of 187 [I-D.ietf-sip-consent-framework]. For PUBLISH requests that are 188 authenticated using the P-Asserted-Identity mechanism, the 189 identity of the sender of the PUBLISH request is equal to the 190 P-Asserted-Identity header field of the request. 192 Return Routability Test, as described in Section 5.6.1.3 of 193 [I-D.ietf-sip-consent-framework]. It can be used for SIP PUBLISH 194 and HTTP GET requests. No authentication is expected to be used 195 with return routability tests and, therefore, no identity matching 196 procedures are defined. 198 SIP digest, as described in Section 5.6.1.4 of 199 [I-D.ietf-sip-consent-framework]. The identity of the sender is 200 set equal to the SIP Address of Record (AOR) for the user that has 201 authenticated themselves. 203 3.1.2. Identity Condition 205 The identity condition, which is defined in [RFC4745], is matched 206 against the URI of the sender of the request that is used as input 207 for a translation. 209 When performing a translation, a relay matches the identity condition 210 against the identity of the sender of the incoming request. If they 211 match, the identity condition evaluates to TRUE. Otherwise, the 212 identity condition evaluates to FALSE. 214 Since only authenticated identities can be matched, the following 215 subsections define acceptable means of authentication, the procedure 216 for representing the identity of the sender as a URI, and the 217 procedure for converting an identifier of the form user@domain, 218 present in the 'id' attribute of the and elements, 219 into a URI. 221 3.1.2.1. Acceptable Means of Authentication 223 When used with SIP, a request sent by a sender is considered 224 authenticated if one of the following techniques is used: 226 SIP Digest: the relay authenticates the sender using SIP digest 227 authentication [RFC2617]. However, if the anonymous 228 authentication described on page 194 of [RFC3261] is used, the 229 sender is not considered authenticated. 231 Asserted Identity: if a request contains a P-Asserted-ID header 232 field [RFC3325] and the request is coming from a trusted element, 233 the sender is considered authenticated. 235 Cryptographically Verified Identity: if a request contains an 236 Identity header field as defined in [RFC4474], and it validates 237 the From header field of the request, the request is considered to 238 be authenticated. Note that this is true even if the request 239 contained a From header field of the form 240 sip:anonymous@example.com. As long as the signature verifies that 241 the request legitimately came from this identity, it is considered 242 authenticated. 244 3.1.2.2. Computing a URI for the Sender 246 For requests that are authenticated using SIP Digest, the identity of 247 the sender is set equal to the SIP Address of Record (AOR) for the 248 user that has authenticated themselves. For example, consider the 249 following "user record" in a database: 251 SIP AOR: sip:alice@example.com 252 digest username: ali 253 digest password: f779ajvvh8a6s6 254 digest realm: example.com 256 If the relay receives a request, challenges it with the realm set to 257 "example.com", and the subsequent request contains an Authorization 258 header field with a username of "ali" and a digest response generated 259 with the password "f779ajvvh8a6s6", the identity used in matching 260 operations is "sip:alice@example.com". 262 For requests that are authenticated using [RFC3325], the identity of 263 the sender is equal to the SIP URI in the P-Asserted-ID header field. 264 If there are multiple values for the P-Asserted-ID header field 265 (there can be one sip URI and one tel URI [RFC3966]), then each of 266 them is used for the comparisons outlined in [RFC4745], and if either 267 of them match a or element, it is considered a match. 269 For requests that are authenticated using the SIP Identity mechanism 270 [RFC4474], identity of the sender is equal to the SIP URI in the From 271 header field of the request, assuming that the signature in the 272 Identity header field has been validated. 274 SIP also allows for anonymous requests. If a request is anonymous 275 because the digest challenge/response used the "anonymous" username, 276 the request is considered unauthenticated and will not match the 277 condition. If a request is anonymous because it contains 278 a Privacy header field [RFC3323], but still contains a P-Asserted-ID 279 header field, the identity in the P-Asserted-ID header field is still 280 used in the authorization computations; the fact that the request was 281 anonymous has no impact on the identity processing. However, if the 282 request had traversed a trust boundary and the P-Asserted-ID header 283 field and the Privacy header field had been removed, the request will 284 be considered unauthenticated when it arrives at the relay, and thus 285 not match the condition. Finally, if a request contained an 286 Identity header field that was validated, and the From header field 287 contained a URI of the form sip:anonymous@example.com, then the 288 sender is considered authenticated, and it will have an identity 289 equal to sip:anonymous@example.com. Had such an identity been placed 290 into a or element, there will be a match. 292 3.1.2.3. Computing a SIP URI from the id Attribute 294 If the or condition does not contain a scheme, 295 conversion of the value in the 'id' attribute to a SIP URI is done 296 trivially. If the characters in the 'id' attribute are valid 297 characters for the user and hostpart components of the SIP URI, a 298 'sip:' is appended to the contents of the 'id' attribute, and the 299 result is the SIP URI. If the characters in the 'id' attribute are 300 not valid for the user and hostpart components of the SIP URI, 301 conversion is not possible and, thus, the identity condition 302 evaluates to FALSE. This happens, for example, when the user portion 303 of the 'id' attribute contains UTF-8 characters. 305 3.1.3. Target Condition 307 The target condition is matched against the target URI of a 308 translation. The target condition can contain the same elements and 309 attributes as identity conditions. 311 When performing a translation, a relay matches the target condition 312 against the destination of the incoming request, which is typically 313 contained in the Request-URI. If they match, the target condition 314 evaluates to TRUE. Otherwise, the target condition evaluates to 315 FALSE. 317 3.1.4. Validity Condition 319 The element is not applicable to this document. Each 320 permission element has an infinite lifetime and can be revoked using 321 an independent mechanism, as described in Section 5.8 of 322 [I-D.ietf-sip-consent-framework]. In any case, as discussed in 323 Section 4.1 of [I-D.ietf-sip-consent-framework], permissions are only 324 valid as long as the context where they were granted is valid. If 325 present, elements MUST be ignored. 327 3.1.5. Sphere Condition 329 The element is not applicable to this document and therefore 330 is not used. If present, elements MUST be ignored. 332 3.2. Actions 334 The actions in a permission document provide URIs to grant or deny 335 permission to perform the translation described in the document. 337 Note that the element is not an action, as 338 defined in Common Policy [RFC4745], but rather an informational 339 element. Therefore, the conflict resolution mechanism does not 340 apply to it. 342 Each policy rule contains at least two elements; one 343 element with a URI to grant and another with a URI to deny 344 permission. 346 3.2.1. Translation Handling 348 The provides URIs for a recipient to grant or deny 349 the relay permission to perform a translation. The defined values 350 are: 352 deny: this action tells the relay not to perform the translation. 354 grant: this action tells the server to perform the translation. 356 The 'perm-uri' attribute in the element provides a 357 URI to grant or deny permission to perform a translation. 359 4. Example Document 361 In the following example, a client adds 'sip:bob@example.org' to the 362 translation whose Target URI is 'sip:alices-friends@example.com'. 363 The relay handling the translation generates the following permission 364 document in order to ask for permission to relay requests sent to 365 'sip:alices-friends@example.com' to 'sip:bob@example.org'. The 366 Target URI is 'sip:alices-friends@example.com', and the Recipient URI 367 is 'sip:bob@example.org'. The sender's identity does not play a role 368 in this example. Therefore, the permission document does not put any 369 restriction on potential senders. 371 +--------+ +--------------------------------+ Permission 372 | | | | Request 373 | Client | | Relay | with 374 | | | sip:alices-friends@example.com | Permission 375 +--------+ | | Document 376 | |+-------+ |-------------+ 377 | ||Transl.| | | 378 |Manipulation ||Logic | | | 379 +------------>|+-------+ | | 380 Add +--------------------------------+ | 381 sip:bob@example.org V 382 +---------------------+ 383 | | 384 | Recipient | 385 | sip:bob@example.org | 386 | | 387 +---------------------+ 389 390 394 395 396 397 398 399 400 401 402 403 404 405 406 407 409 grant 410 412 grant 413 415 deny 416 418 deny 419 420 421 422 424 5. XML Schema 425 426 434 435 436 438 439 440 441 442 443 444 446 447 448 449 450 452 453 454 455 457 459 6. IANA Considerations 461 This section registers a new XML namespace and a new XML schema per 462 the procedures in [RFC3688]. 464 6.1. XML Namespace Registration 466 URI: urn:ietf:params:xml:ns:consent-rules 468 Registrant Contact: IETF SIPPING working group, 469 , Gonzalo Camarillo 470 471 XML: 473 BEGIN 474 475 477 478 479 481 Consent Rules Namespace 482 483 484

Namespace for Permission Documents

485

urn:ietf:params:xml:ns:consent-rules

486

See RFCXXXX 487 [NOTE TO IANA/RFC-EDITOR: 488 Please replace XXXX with the RFC number of this 489 specification.].

490 491 492 END 494 6.2. XML Schema Registration 496 URI: urn:ietf:params:xml:schema:consent-rules 498 Registrant Contact: IETF SIPPING working group, 499 , Gonzalo Camarillo 500 502 XML: The XML schema to be registered is contained in Section 5. 504 7. Security Considerations 506 The framework for consent-based communications in the Session 507 Initiation Protocol (SIP) [I-D.ietf-sip-consent-framework] discusses 508 security-related issues, such as how to authenticate SIP and HTTP 509 requests granting permissions and how to transport permission 510 documents between relays and recipients, that are directly related to 511 this specification. 513 8. Acknowledgements 515 Jonathan Rosenberg provided useful ideas on this document. Hannes 516 Tschofenig helped align this document with common policy. Ben 517 Campbell and Mary Barnes performed a thorough review of this 518 document. Lakshminath Dondeti provided useful comments. 520 9. References 522 9.1. Normative References 524 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 525 Requirement Levels", BCP 14, RFC 2119, March 1997. 527 [RFC2617] Franks, J., Hallam-Baker, P., Hostetler, J., Lawrence, S., 528 Leach, P., Luotonen, A., and L. Stewart, "HTTP 529 Authentication: Basic and Digest Access Authentication", 530 RFC 2617, June 1999. 532 [RFC3261] Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston, 533 A., Peterson, J., Sparks, R., Handley, M., and E. 534 Schooler, "SIP: Session Initiation Protocol", RFC 3261, 535 June 2002. 537 [RFC3323] Peterson, J., "A Privacy Mechanism for the Session 538 Initiation Protocol (SIP)", RFC 3323, November 2002. 540 [RFC3688] Mealling, M., "The IETF XML Registry", BCP 81, RFC 3688, 541 January 2004. 543 [RFC4474] Peterson, J. and C. Jennings, "Enhancements for 544 Authenticated Identity Management in the Session 545 Initiation Protocol (SIP)", RFC 4474, August 2006. 547 [RFC4745] Schulzrinne, H., Tschofenig, H., Morris, J., Cuellar, J., 548 Polk, J., and J. Rosenberg, "Common Policy: A Document 549 Format for Expressing Privacy Preferences", RFC 4745, 550 February 2007. 552 [I-D.ietf-sip-consent-framework] 553 Rosenberg, J., Camarillo, G., and D. Willis, "A Framework 554 for Consent-based Communications in the Session Initiation 555 Protocol (SIP)", draft-ietf-sip-consent-framework-04 (work 556 in progress), January 2008. 558 9.2. Informative References 560 [RFC3966] Schulzrinne, H., "The tel URI for Telephone Numbers", 561 RFC 3966, December 2004. 563 [RFC3325] Jennings, C., Peterson, J., and M. Watson, "Private 564 Extensions to the Session Initiation Protocol (SIP) for 565 Asserted Identity within Trusted Networks", RFC 3325, 566 November 2002. 568 Author's Address 570 Gonzalo Camarillo 571 Ericsson 572 Hirsalantie 11 573 Jorvas 02420 574 Finland 576 Email: Gonzalo.Camarillo@ericsson.com 578 Full Copyright Statement 580 Copyright (C) The IETF Trust (2008). 582 This document is subject to the rights, licenses and restrictions 583 contained in BCP 78, and except as set forth therein, the authors 584 retain all their rights. 586 This document and the information contained herein are provided on an 587 "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS 588 OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND 589 THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS 590 OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF 591 THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED 592 WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. 594 Intellectual Property 596 The IETF takes no position regarding the validity or scope of any 597 Intellectual Property Rights or other rights that might be claimed to 598 pertain to the implementation or use of the technology described in 599 this document or the extent to which any license under such rights 600 might or might not be available; nor does it represent that it has 601 made any independent effort to identify any such rights. Information 602 on the procedures with respect to rights in RFC documents can be 603 found in BCP 78 and BCP 79. 605 Copies of IPR disclosures made to the IETF Secretariat and any 606 assurances of licenses to be made available, or the result of an 607 attempt made to obtain a general license or permission for the use of 608 such proprietary rights by implementers or users of this 609 specification can be obtained from the IETF on-line IPR repository at 610 http://www.ietf.org/ipr. 612 The IETF invites any interested party to bring to its attention any 613 copyrights, patents or patent applications, or other proprietary 614 rights that may cover technology that may be required to implement 615 this standard. Please address the information to the IETF at 616 ietf-ipr@ietf.org. 618 Acknowledgment 620 Funding for the RFC Editor function is provided by the IETF 621 Administrative Support Activity (IASA).