On-Demand Access Authorization for SIP Event Subscriptions D. Trossen, H. Schulzrinne

Whats The Problem? Or What Does On-Demand Mean? Problem: Querier desires (temporary) access to resource, hosted at resource data provider Access can be limited in time (e.g., for 10 minutes after subscription granted, from 1pm to 2pm today) or limited in notifications (one-time or N-time access) Solve: Enable authorized access for this subscription Important: Enable access for this very subscription only! Other constraints: Identity of querier might not be known to resource owner beforehand Resource data, e.g., presence items, might not be known to resource owner beforehand Conveyance of access desire and actual access might lie within short time window Use Cases: Location scenarios, content adaptation, service discovery,… (see draft!) Querier Resource owner Resource Data provider Access conveyance of access desire Authorization (SIP Event Server) (e.g., presentity) (subscriber)

Requirements Requirements for possible solutions are concerned with Identification of pieces of resource data to be accessed (REQ 1) Identity verification of resource owner (REQ 2) and querier (REQ 5) Binding of (temporary) access to particular subscription (REQ 3) Time-window constraint (REQ 4) Enabling notification restriction (REQ 6) Avoidance of subscription rejection because of racing conditions (REQ 7) The last four items are particularly imposed by the use cases!

Possible Solution Space 1.Set proper authorization via XCAP after conveyance of access desire 2.Use temporary accounts within XCAP system for particular types of access 3.Create ticket for particular access/querier and hand to querier 4.Authenticate message body for subscription at resource owner and had to querier to be used in SIP SUBSCRIBE 5.Use watcherinfo subscription and reply directly to event server upon watcherinfo notification Note: All solutions are incomplete and insufficiently specified today!

Questions to the WG Are the use cases relevant? Do we need more (convincing) ones? Or in other words, is there demand for solutions to the problem? How to proceed? What shall be the focus in the solution space? XCAP (V x.0)? Refine requirements? Particularly for certain solutions like XCAP? Can we assume certain conveyance methods? Is watcherinfo a MUST? Is SOAP possible?