Re: Authentication/Authorization Issues: Re: [Geopriv] coming to termson location by reference

Hi Brian,

Brian Rosen schrieb:
>> One might further detail the scenarios. I was just wondering whether the
>> Reference Creator has the information to build a PIDF-LO. If there is a
>> relationship between the Reference Creator and the Target then things
>> are much simpler. There are, however, some applicability statements /
>> assumptions around this.
> It can build a PIDF-LO. The question is what identity is provided in the
> PIDF.

True. What information is placed into the PIDF part and what information
is placed into PIDF-LO rule sets.

>
>> To address the case where there is no relationship between the Reference
>> Creator and the Target HELD has taken the approach to upload identity
>> and privacy policy information to the LIS.
> I think it's essential to have the target control the policy.

Then, the question remains: How.

   I think the
> access network creating an identity that is meaningful to anyone else is
> problematic and not helpful.

I have several times stated the question whether the identity field has
some semantic associated. Nobody ever responded. I don't know whether
you can just put garbage in there.

>
> ...snip...
>>> I would think in the former case that:
>>> a) The access network MUST obtain policy from its subscriber in order to
>>> meet Geopriv requirements.
>>> b) The location provided would probably NOT have any identity
>> information
>>
>> entity element in the PIDF-LO = empty.
> Well, at least anonymous

Fine with me.

>
> ...snip....
>> Do you think that the access network needs to have possession of the
>> authorization policies ? (as, for example, provided by HELD)
> Yes, I think it does

Ok.

>
> ...snip...
>>> identity of the target to watch; all he needs is the URL. If the URL
>>> contains no identity information, which in this case it should, then I
>> think
>>> everything is ok except the "how do you tell an emergency case"
>> problem.
>> I am not sure that this works. How do you make the differentiation
>> between a PSAP and an arbitrary Location Recipient when they ask for
>> location at the LIS/presence server without authenticating them first?
> I don't really know how to do this in a way that a protocol can implement.
> I think you can do it in a way that a lawsuit would work.
>
> Let me point out that if you take the purpose of the location reference to
> get location AND NOTHING ELSE, then a PIDF with the -LO and no/anonymous
> identity serves you well. If you want an identity, then I think you really
> do have presence, and you should use it, and not create something that is
> identity+location, but not presence.

Ok.

>
> Basically, since I don't see how anyone will link an access network's notion
> of identity with any other identity (say your AoR for a phone or IM
> service), then I don't think the access network identity is useful for
> anything outside its domain.

I have no idea either how this would work. At least it does not work in
almost all of the scenarios.

Ciao
Hannes

>
> Brian
>
>

_______________________________________________
Geopriv mailing list
Geopriv@ietf.org
https://www1.ietf.org/mailman/listinfo/geopriv
Received on Wed, 13 Sep 2006 22:29:52 +0200