[Kamailio-Devel] [ openser-Bugs-2740437 ] PUBLISH authentication is wrong

[Jan Janak]

On 17-04 11:01, Iñaki Baz Castillo wrote:
> 2009/4/17 Klaus Darilion <klaus.mailinglists at pernau.at>:
> > So, there is just one thing left: if using proxy/www_authorize without
> > specifying the realm manually, the realm will be calculated dynamically -
> > currently From domain except for REGISTER the To domain is used. Thus, to
> > follow this tradition the RURI domain needs to be used for RURI - by using
> > always From header the 3rd party publication/registration will not work if
> > the 3rd party will use a different domain. Today I think using RURI domain
> > for auto-realm-calculation for PUBLISH is the correct fix.
> 
> Sincerelly I think that selecting To domain as realm in REGISTER is
> also wrong. You explained above very well the difference between
> authentication and authorization, and I think that proxy_authorize()
> function mixes both:
> 
> Authentication verifies the identity of the sender (not of the target
> AoR). In a REGISTER, the sender (as in any request) is the From URI,
> not the To URI. Let's show a case of third party registration:
> 
>   REGISTER sip:server
>   From: alice at atlanta.com
>   To: bob at biloxi.net
> 
> The sender is alice, so the realm in 401 should be "atlanta.com". Here
> the authentication ends.
> Later we can check the *authorization* by using check_to(). If
> check_to() returns false then we could query some table to find if
> alice at atlanta.com is allowed to register bob at biloxi.net AoRo.
> 
> First authentication, after that, authorization. Why proxy_authorize()
> and www_authorize() pre-checks the authorization by choosing a realm
> *not* based on the sender (From)?
> 
> In conclusion: IMHO proxy_authorize() and www_authorize() should use
> From domain as realm by default, also in REGISTER and PUBLISH. I'd
> like to insist: authentication is the verification of the *sender*,
> and the *sender* is always the From.

I agree. This is also how we do it in the default configuration file of
SER. We select the virtual domain to be used based on the domain part of the