VoIP Meeting Authentication/Authorization 19/04/2006 Bea Huber, Fabio Vena

Roll Call Jan Ruzicka (CESNET) Erik Dobbelsteijn (SURFNET) Joao Pereira (FCCN) Antonio Pinizzotto, Marco Sommani (CNR) Bea Huber, Fabio Vena (SWITCH)

Meeting Objectives In this meeting we talked about the different AA mechanisms used in SIP deployments and discuss how existing AA Infrastructures (Radius/Eduroam, LDAP, SAML/Shibboleth/A-Select...) can be used also for SIP AA. In relation with the last Meeting (Architectures) we also discussed if it makes sense to have a centralized or a decentralized AA mechanism.

Enduser - Server Auth I FCCN: prefers decentralized architecture and authentication mechanism start with a centralized solution, slowly implement the sip domains in the university putting gateways in the legacy pbx, IP based auth. in the central services, central proxy CNR: Deploys 2 infrastructures, auth is important only when calls are routet to telco Architectures is decentralized, organisation is responsible for auth.

Enduser - Server Auth II CESNET: H.323 centralized - Central gatekeepers for pbx gateways and on demand accounts for IP clients at cesnet gk.SIP hybrid. Start point - multidomain proxy, serving the domains of institutions to show the service (on demand, need for SRV records in the name servers of the institution, 4 at this time). Local SIP accounts are created after succesful eduroam authentication (in the home domain). Centralized Call-in possibility - calls to connected institution pbxs could be routed domain.SIP final state - decentralized as much as possible - better integration into institutional environment, decentralized (home)AA for intra domain and sort of federated AA for interdomain and shared resources like MCU and so on.

Enduser - Server Auth III SURFNET: A-Select......, concentrating in webbased clients, radius based auth for other clients. SWITCH: Wants to use existing Auth mechanisms such as Shibboleth or Radius. But hard to implement especially in centralized architecture. As an alternative implement decentralized architecture. Each institution choose auth mechanisms according to their existing infrastructure. Radius login are already in wide use in conjunction with eduroam and can be reused for SIP auth.

Enduser - Enduser Auth FCCN already tested EE Auth with certificates, used self-signed or free certificates? SWITCH mentioned that there are activities to establish Terena Certificates and this CA could also be used for SIP AA. EE Auth not tested with SBC‘s which acts as Back-to-back UA.

Conclusion Distributed architecture to avoid auth problems, local attached databases, currently yes, nut no happy solution

AOB Discussion about TNC SIP Workshop We should hold a BOF for take some conclusion of this meetings and decide how to go on, TF? Fabio will contact Catalin for organizing it Flip ENUM / Billing Meeting next week