SIMPLE J. Rosenberg
Internet-Draft Cisco
Intended status: Informational A. Houri
Expires: August 24, 2008 IBM
February 21, 2008
Models for Intra-Domain Presence Federation
draft-ietf-simple-intradomain-federation-00
Status of this Memo
By submitting this Internet-Draft, each author represents that any
applicable patent or other IPR claims of which he or she is aware
have been or will be disclosed, and any of which he or she becomes
aware will be disclosed, in accordance with Section 6 of BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF), its areas, and its working groups. Note that
other groups may also distribute working documents as Internet-
Drafts.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
The list of current Internet-Drafts can be accessed at
http://www.ietf.org/ietf/1id-abstracts.txt.
The list of Internet-Draft Shadow Directories can be accessed at
http://www.ietf.org/shadow.html.
This Internet-Draft will expire on August 24, 2008.
Copyright Notice
Copyright (C) The IETF Trust (2008).
Abstract
Presence federation involves the sharing of presence information
across multiple presence systems. Most often, presence federation is
assumed to be between different organizations, such as between two
enterprises or between and enterprise and a service provider.
However, federation can occur within a single organization or domain.
This can be the result of a multi-vendor network, or a consequence of
a large organization that requires partitioning. This document
Rosenberg & Houri Expires August 24, 2008 [Page 1]
Internet-Draft Intra-Domain Presence Federation February 2008
examines different use cases and models for intra-domain federation.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 4
2. Intra-Domain Federation vs. Clustering . . . . . . . . . . . . 5
3. Use Cases for Intra-Domain Federation . . . . . . . . . . . . 6
3.1. Scale . . . . . . . . . . . . . . . . . . . . . . . . . . 7
3.2. Organizational Structures . . . . . . . . . . . . . . . . 7
3.3. Multi-Vendor Requirements . . . . . . . . . . . . . . . . 7
3.4. Specialization . . . . . . . . . . . . . . . . . . . . . . 7
4. Considerations for Federation Models . . . . . . . . . . . . . 8
5. Partitioned . . . . . . . . . . . . . . . . . . . . . . . . . 9
5.1. Applicability . . . . . . . . . . . . . . . . . . . . . . 10
5.2. Routing . . . . . . . . . . . . . . . . . . . . . . . . . 10
5.2.1. Centralized Database . . . . . . . . . . . . . . . . . 11
5.2.2. Routing Proxy . . . . . . . . . . . . . . . . . . . . 12
5.2.3. Subdomaining . . . . . . . . . . . . . . . . . . . . . 13
5.2.4. Peer-to-Peer . . . . . . . . . . . . . . . . . . . . . 15
5.2.5. Forking . . . . . . . . . . . . . . . . . . . . . . . 15
5.2.6. Provisioned Routing . . . . . . . . . . . . . . . . . 15
5.3. Policy . . . . . . . . . . . . . . . . . . . . . . . . . . 15
5.4. Presence Data . . . . . . . . . . . . . . . . . . . . . . 16
6. Exclusive . . . . . . . . . . . . . . . . . . . . . . . . . . 16
6.1. Routing . . . . . . . . . . . . . . . . . . . . . . . . . 17
6.1.1. Centralized Database . . . . . . . . . . . . . . . . . 17
6.1.2. Routing Proxy . . . . . . . . . . . . . . . . . . . . 18
6.1.3. Subdomaining . . . . . . . . . . . . . . . . . . . . . 18
6.1.4. Peer-to-Peer . . . . . . . . . . . . . . . . . . . . . 18
6.1.5. Forking . . . . . . . . . . . . . . . . . . . . . . . 18
6.2. Policy . . . . . . . . . . . . . . . . . . . . . . . . . . 19
6.3. Presence Data . . . . . . . . . . . . . . . . . . . . . . 19
7. Unioned . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
7.1. Hierarchical Model . . . . . . . . . . . . . . . . . . . . 23
7.1.1. Routing . . . . . . . . . . . . . . . . . . . . . . . 25
7.1.2. Policy and Identity . . . . . . . . . . . . . . . . . 26
7.1.2.1. Root Only . . . . . . . . . . . . . . . . . . . . 26
7.1.2.2. Distributed Provisioning . . . . . . . . . . . . . 28
7.1.2.3. Central Provisioning . . . . . . . . . . . . . . . 29
7.1.3. Presence Data . . . . . . . . . . . . . . . . . . . . 31
7.2. Peer Model . . . . . . . . . . . . . . . . . . . . . . . . 31
7.2.1. Routing . . . . . . . . . . . . . . . . . . . . . . . 33
7.2.2. Policy . . . . . . . . . . . . . . . . . . . . . . . . 34
7.2.3. Presence Data . . . . . . . . . . . . . . . . . . . . 34
8. Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
9. Future Considerations . . . . . . . . . . . . . . . . . . . . 35
10. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 35
Rosenberg & Houri Expires August 24, 2008 [Page 2]
Internet-Draft Intra-Domain Presence Federation February 2008
11. Security Considerations . . . . . . . . . . . . . . . . . . . 35
12. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 35
13. Informative References . . . . . . . . . . . . . . . . . . . . 35
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 36
Intellectual Property and Copyright Statements . . . . . . . . . . 38
Rosenberg & Houri Expires August 24, 2008 [Page 3]
Internet-Draft Intra-Domain Presence Federation February 2008
1. Introduction
Presence refers to the ability, willingness and desire to communicate
across differing devices, mediums and services [RFC2778]. Presence
is described using presence documents [RFC3863] [RFC4479], exchanged
using a SIP-based event package [RFC3856]
Presence federation refers to the sharing of presence information
across multiple presence systems. This interconnection involves
passing of subscriptions from one system to another, and then the
passing of notifications in the opposite direction.
Most often, presence federation is considered in the context of
interconnection between different domains, also known as inter-domain
presence federation
[I-D.ietf-speermint-consolidated-presence-im-usecases]. For example,
consider the network of Figure 1, which shows one model for inter-
domain federation. In this network, Alice belongs to the example.org
domain, and Bob belongs to the example.com domain. Alice subscribes
to her buddy list on her presence server (which is also acting as her
Resource List Server (RLS) [RFC4662]), and that list includes
bob@example.com. Alice's presence server generates a back-end
subscription on the federated link between example.org and
example.com. The example.com presence server authorizes the
subscription, and if permitted, generates notifications back to
Alice's presence server, which are in turn passed to Alice.
Rosenberg & Houri Expires August 24, 2008 [Page 4]
Internet-Draft Intra-Domain Presence Federation February 2008
............................. ..............................
. . . .
. . . .
. alice@example.org . . bob@example.com .
. +------------+ SUB . . +------------+ .
. | | Bob . . | | .
. | Presence |------------------->| Presence | .
. | Server | . . | Server | .
. | | . . | | .
. | |<-------------------| | .
. | | NOTIFY . | | .
. +------------+ . . +------------+ .
. ^ | . . ^ .
. SUB | | . . |PUB .
. Buddy | |NOTIFY . . | .
. List | | . . | .
. | | . . | .
. | V . . | .
. +-------+ . . +-------+ .
. | | . . | | .
. | | . . | | .
. | | . . | | .
. +-------+ . . +-------+ .
. . . .
. Alice's . . Bob's .
. PC . . PC .
. . . .
............................. ..............................
example.org example.com
Figure 1: Inter-Domain Model
However, federation can happen within a domain as well. We define
intra-domain federation as the interconnection of presence servers
within a single domain, where domain refers explicity to the right
hand side of the @-sign in the SIP URI.
2. Intra-Domain Federation vs. Clustering
Intra-domain federation is the interconnection of presence servers
within a single domain. This is very similar to clustering, which is
the tight coupling of a multiplicity of physical servers to realize
scale and/or high availability. Consequently, it is important to
clarify the differences.
Rosenberg & Houri Expires August 24, 2008 [Page 5]
Internet-Draft Intra-Domain Presence Federation February 2008
Firstly, clustering implies a tight coupling of components.
Clustering usually involves proprietary information sharing, such as
database replication and state sharing, which in turn are tightly
bound with the internal implementation of the product. Intra-domain
federation, on the other hand, is a loose coupling. There is never
database replication or state replication across federated systems.
Secondly, clustering always occurs amongst components from the same
vendor. This is due to the tight coupling described above. Intra-
domain federation, on the other hand, can occur between servers from
different vendors. As described below, this is one of the chief use
cases for intra-domain federation.
Thirdly, clustering is almost always invisible to users.
Communications between users within the same cluster almost always
have identical functionality to communications between users on the
same server within the cluster. The cluster boundaries are
invisible; indeed the purpose of a cluster is to build a system which
behaves as if it were a single monolithic entity, even though it is
not. Federation, on the other hand, is often visible to users.
There will frequently be loss of functionality when crossing a
cluster. Though this is not a hard and fast rule, it is a common
differentiator.
Fourthly, connections between federated systems almost always involve
standards, whereas communications within a cluster often involves
proprietary mechanisms. Standards are needed for federation because
the federated systems can be from different vendors, and thus
agreement is needed to enable interoperation.
Finally, a cluster will often have an upper bound on its size and
capacity, due to some kind of constraint on the coupling between
nodes in the cluster. However, there is typically no limit, or a
much larger limit, on the number of federated systems that can be put
into a domain. This is a consequence to their loose coupling.
Though these rules are not hard and fast, they give general
guidelines on the differences between clustering and intra-domain
federation.
3. Use Cases for Intra-Domain Federation
There are several use cases that drive intra-domain federation.
Rosenberg & Houri Expires August 24, 2008 [Page 6]
Internet-Draft Intra-Domain Presence Federation February 2008
3.1. Scale
One common use case for federation is an organization that is just
very large, and their size exceeds the capacity that a single server
or cluster can provide. So, instead, the domain breaks its users
into partitions (perhaps arbitrarily) and then uses intra-domain
federation to allow the overall system to scale up to arbitrary
sizes. This is common practice today for service providers and large
enterprises.
3.2. Organizational Structures
Another use case for intra-domain federation is a multi-national
organization with regional IT departments, each of which supports a
particular set of nationalities. It is very common for each regional
IT department to deploy and run its own servers for its own
population. In that case, the domain would end up being composed of
the presence servers deployed by each regional IT department.
Indeed, in many organizations, each regional IT department might end
up using different vendors. This can be a consequence of differing
regional requirements for features (such as compliance or
localization support), differing sales channels and markets in which
vendors sell, and so on.
3.3. Multi-Vendor Requirements
Another use case for intra-domain federation is an organization that
requires multiple vendors for each service, in order to avoid vendor
lock in and drive competition between its vendors. Since the servers
will come from different vendors, a natural way to deploy them is to
partition the users across them. Such multi-vendor networks are
extremely common in large service provider networks, many of which
have hard requirements for multiple vendors.
Typically, the vendors are split along geographies, often run by
different local IT departments. As such, this case is similar to the
organizational division above.
3.4. Specialization
Another use case is where certain vendors might specialize in
specific types of clients. For example, one vendor might provide a
mobile client (but no desktop client), while another provides a
desktop client but no mobile client. It is often the case that
specific client applications and devices are designed to only work
with their corresponding servers. In an ideal world, clients would
all implement to standards and this would not happen, but in
practice, the vast majority of presence endpoints work only (or only
Rosenberg & Houri Expires August 24, 2008 [Page 7]
Internet-Draft Intra-Domain Presence Federation February 2008
work well) with the server from the same vendor. A domain might want
each user to have both a mobile client and a desktop client, which
will require servers from each vendor, leading to intra-domain
federation.
Similarly, presence can contain rich information, including
activities of the user (such as whether they are in a meeting or on
the phone), their geographic location, and their mood. This presence
state is can be determined manually (where the user enters and
updates the information), or automatically. Automatic determination
of these states is far preferable, since it put less burden on the
user. Determination of these presence states is done by taking "raw"
data about the user, and using it to generate corresponding presence
states. This raw data can come from any source that has information
about the user, including their calendaring server, their VoIP
infrastructure, their VPN server, their laptop operating system, and
so on. Each of these components is typically made by different
vendors, each of which is likely to integrate that data with their
presence servers. Consequently, presence servers from different
vendors are likely to specialize in particular pieces of presence
data, based on the other infrastructure they provide. The overall
network will need to contain servers from both vendors in order to
combine the benefits of both. This results in intra-domain
federation.
4. Considerations for Federation Models
When considering architectures for intra-domain presence federation,
several issues need to be considered:
Routing: How are subscriptions routed to the right presence
server(s)? This issue is more complex in intra-domain models,
since the right hand side of the @-sign cannot be used to perform
this routing.
Policy and Identity: Where do user policies reside, and what
presence server(s) are responsible for executing that policy?
What identities does the user have in each system and how do they
relate?
Data Ownership: Which presence servers are responsible for which
pieces of presence information, and how are those pieces composed
to form a coherent and consistent view of user presence?
The sections below describe several different models for intra-domain
federation. Each model is driven by a set of use cases, which are
described in an applicability subsection for each model. Each model
Rosenberg & Houri Expires August 24, 2008 [Page 8]
Internet-Draft Intra-Domain Presence Federation February 2008
description also discusses how routing, policy, and composition work.
5. Partitioned
In the partitioned model, a single domain has a multiplicity of
presence servers, each of which manages a non-overlapping set of
users. That is, for each user in the domain, their presence data and
policy reside on a single server. Each "single server" may in fact
be a cluster.
Another important facet of the partitioned model is that, even though
users are partitioned across different servers, they each share the
same domain name in the right hand side of their URI, and this URI is
what those users use when communicating with other users both inside
and outside of the domain. There are many reasons why a domain would
want all of its users to share the same right-hand side of the @-sign
even though it is partitioned internally:
o The partitioning may reflect organizational or geographical
structures that a domain admistrator does not want to reflect
externally.
o If each partition had a separate domain name (i.e.,
engineering.example.com and sales.example.com), if a user changed
organizations, this would necessitate a change in their URI.
o For reasons of vanity, users often like to have their URI (which
appear on business cards, email, and so on), to be brief and
short.
o If a watcher wants to add a presentity based on username and does
not want to know, or does not know, which subdomain or internal
dept the presentity belongs to, a single domain is needed.
This model is illustrated in Figure 2. As the model shows, the
domain example.com has six users across three servers, each of which
is handling two of the users.
Rosenberg & Houri Expires August 24, 2008 [Page 9]
Internet-Draft Intra-Domain Presence Federation February 2008
.....................................................................
. .
. .
. .
. joe@example.com alice@example.com padma@example.com .
. bob@example.com zeke@example.com hannes@example.com .
. +-----------+ +-----------+ +-----------+ .
. | | | | | | .
. | Server | | Server | | Server | .
. | 1 | | 2 | | 3 | .
. | | | | | | .
. +-----------+ +-----------+ +-----------+ .
. .
. .
. .
. example.com .
.....................................................................
Figure 2: Partitioned Model
5.1. Applicability
The partitioned model arises naturally in larger domains, such as an
enterprise or service provider, where issues of scale, organizational
structure, or multi-vendor requirements cause the domain to be
managed by a multiplicity of independent servers.
In cases where each user has an AoR that directly points to its
partition (for example, us.example.com), that model becomes identical
to the inter-domain federated model and is not treated here further.
[[OPEN ISSUE: there are differences though, such as acess to a
centralized database. Is it worth adding this as a FOURTH model?]]
5.2. Routing
The partitioned intra-domain model works almost identically to an
inter-domain federated model, with the primary difference being
routing. In inter-domain federation, the domain part of the URI can
be used to route presence subscriptions from the watcher's domain to
the domain of the presentity. This is no longer the case in an
intra-domain model. Consider the case where Joe subscribes to his
buddy list, which is served by his presence server (server 1 in
Figure 2). Alice is a member of Joe's buddy list. How does server 1
know that the back-end subscription to Alice needs to get routed to
server 2?
Rosenberg & Houri Expires August 24, 2008 [Page 10]
Internet-Draft Intra-Domain Presence Federation February 2008
5.2.1. Centralized Database
.....................................................................
. +-----------+ .
. alice? | | .
. +---------------> | Database | .
. | server 2 | | .
. | +-------------| | .
. | | +-----------+ .
. | | .
. | | .
. | | .
. | | .
. | | .
. | | .
. | V .
. joe@example.com alice@example.com padma@example.com .
. bob@example.com zeke@example.com hannes@example.com .
. +-----------+ +-----------+ +-----------+ .
. | | | | | | .
. | Server | | Server | | Server | .
. | 1 | | 2 | | 3 | .
. | | | | | | .
. +-----------+ +-----------+ +-----------+ .
. .
. .
. .
. example.com .
.....................................................................
Figure 3: Centralized DB
One solution is to rely on a common, centralized database that
maintains mappings of users to specific servers, shown in Figure 3.
When Joe subscribes to his buddy list that contains Alice, server 1
would query this database, asking it which server is responsible for
alice@example.com. The database would indicate server 2, and then
server 1 would generate the backend SUBSCRIBE request towards server
2. This is a common technique in large email systems. It is often
implemented using internal sub-domains; so that the database would
return alice@central.example.com to the query, and server 1 would
modify the Request-URI in the SUBSCRIBE request to reflect this.
Routing database solutions have the problem that they require
standardization on a common schema and database protocol in order to
work in multi-vendor environments. For example, LDAP and SQL are
Rosenberg & Houri Expires August 24, 2008 [Page 11]
Internet-Draft Intra-Domain Presence Federation February 2008
both possibilities. There is variety in LDAP schema; one possibility
is H.350.4, which could be adapted for usage here [RFC3944].
5.2.2. Routing Proxy
.....................................................................
. +-----------+ .
. SUB alice | | .
. +---------------> | Routing | .
. | | Proxy | .
. | | | .
. | +-----------+ .
. | | .
. | | .
. | | .
. | |SUB Alice .
. | | .
. | | .
. | V .
. joe@example.com alice@example.com padma@example.com .
. bob@example.com zeke@example.com hannes@example.com .
. +-----------+ +-----------+ +-----------+ .
. | | | | | | .
. | Server | | Server | | Server | .
. | 1 | | 2 | | 3 | .
. | | | | | | .
. +-----------+ +-----------+ +-----------+ .
. .
. .
. .
. example.com .
.....................................................................
Figure 4: Routing Proxy
A similar solution is to rely on a routing proxy. Instead of a
centralized database, there would be a centralized SIP proxy farm.
Server 1 would send subscriptions for users it doesn't serve to this
server farm, and the servers would lookup the user in a database
(which is now accessed only by the routing proxy), and the resulting
subscriptions are sent to the correct server. A redirect server can
be used as well, in which case the flow is very much like that of a
centralized database.
Routing proxies have the benefit that they do not require a common
database schema and protocol, but they do require a centralized
Rosenberg & Houri Expires August 24, 2008 [Page 12]
Internet-Draft Intra-Domain Presence Federation February 2008
server function that sees all subscriptions, which can be a scale
challenge.
5.2.3. Subdomaining
In this solution, each user is associated with a subdomain, and is
provisioned as part of their respective presence server using that
subdomain. Consequently, each presence server thinks it is its own,
separate domain. However, when a user adds a presentity to their
buddy list without the subdomain, they first consult a shared
database which returns the subdomained URI to subscribe to. This
sub-domained URI can be returned because the user provided a search
criteria, such as "Find Alice Chang", or provided the non-subdomained
URI (alice@example.com). This is shown in Figure 5
Rosenberg & Houri Expires August 24, 2008 [Page 13]
Internet-Draft Intra-Domain Presence Federation February 2008
.....................................................................
. +-----------+ .
. who is Alice? | | .
. +---------------------->| Database | .
. | alice@b.example.com | | .
. | +---------------------| | .
. | | +-----------+ .
. | | .
. | | .
. | | .
. | | .
. | | .
. | | .
. | | .
. | | joe@a.example.com alice@b.example.com padma@c.example.com .
. | | bob@a.example.com zeke@b.example.com hannes@c.example.com .
. | | +-----------+ +-----------+ +-----------+ .
. | | | | | | | | .
. | | | Server | | Server | | Server | .
. | | | 1 | | 2 | | 3 | .
. | | | | | | | | .
. | | +-----------+ +-----------+ +-----------+ .
. | | ^ .
. | | | .
. | | | .
. | | | .
. | | | .
. | | | .
. | | +-----------+ .
. | +-------------------->| | .
. | | Watcher | .
. | | | .
. +-----------------------| | .
. +-----------+ .
. .
. .
. .
. example.com .
.....................................................................
Figure 5: Subdomaining
Subdomaining puts the burden of routing within the client. The
servers can be completely unaware that they are actually part of the
same domain, and integrate with each other exactly as they would in
an inter-domain model. However, the client is given the burden of
determining the subdomained URI from the original URI or buddy name,
Rosenberg & Houri Expires August 24, 2008 [Page 14]
Internet-Draft Intra-Domain Presence Federation February 2008
and then subscribing directly to that server, or including the
subdomained URI in their buddylist. The client is also responsible
for hiding the subdomain structure from the user and storing the
mapping information locally for extended periods of time. In cases
where users have buddy list subscriptions, the client will need to
resolve the buddy name into the sub-domained version before adding to
their buddy list.
5.2.4. Peer-to-Peer
Another model is to utilize a peer-to-peer network amongst all of the
servers, and store URI to server mappings in the distributed hash
table it creates. This has some nice properties but does require a
standardized and common p2p protocol across vendors, which does not
exist today.
5.2.5. Forking
Yet another solution is to utilize forking. Each server is
provisioned with the domain names or IP addresses of the other
servers, but not with the mapping of users to each of those servers.
When a server needs to create a back-end subscription for a user it
doesn't have, it forks the SUBSCRIBE request to all of the other
servers. This request will be rejected with a 404 on the servers
which do not handle that user, and accepted on the one that does.
The approach assumes that presence servers can differentiate inbound
SUBSCRIBE requests from end users (which cause back-end subscriptions
to get forked) and from other servers (which do not cause back-end
subscriptions). This approach works very well in organizations with
a relatively small number of servers (say, two or three), and becomes
increasingly ineffective with more and more servers.
5.2.6. Provisioned Routing
Yet another solution is to provision each server with each user, but
for servers that don't actually serve the user, the provisioning
merely tells the server where to proxy the request. This solution
has extremely poor operational properties, requiring multiple points
of provisioning across disparate systems.
5.3. Policy
A fundamental characteristic of the partitioned model is that there
is a single point of policy enforcement (authorization rules and
composition policy) for each user.
Rosenberg & Houri Expires August 24, 2008 [Page 15]
Internet-Draft Intra-Domain Presence Federation February 2008
5.4. Presence Data
Another fundamental characteristic of the partitioned model is that
the presence data for a user is managed authoritatively on a single
server. In the example of Figure 2, the presence data for Alice
lives on server 2 alone (recall that server two may be physically
implemented as a multiplicity of boxes from a single vendor, each of
which might have a portion of the presence data, but externally it
appears to behave as if it were a single server). A subscription
from Bob to Alice may cause a transfer of presence information from
server 2 to server 1, but server 2 remains authoritative and is the
single root source of all data for Alice.
6. Exclusive
In the former (static) partitioned model, the mapping of a user to a
specific server is done by some off-line configuration means. The
configuration assigns a user to a specific server and in order to use
a different server, the user needs to change (or request the
administrator to do so) the configuration.
In some environments, this restriction of a user to use a particular
server may be a limitation. Instead, it is desirable to allow users
to freely move back and forth between systems, though using only a
single one at a time. This is called Exclusive Federation.
Some use cases where this can happen are:
o The organization is using multiple systems where each system has
its own characteristics. For example one server is tailored to
work with some CAD (Computer Aided Design) system and provide
presence and IM functionality along with the CAD system. The
other server is the default presence and IM server of the
organization. Users wish to be able to work with either system
when they wish to, they also wish to be able to see the presence
and IM with their buddies no matter which system their buddies are
currently using.
o An enterprise wishes to test presence servers from two different
vendors. In order to do so they wish to install a server from
each vendor and see which of the servers is better. In the static
partitioned model, a user will have to be statically assigned to a
particular server and could not compare the features of the two
servers. In the dynamic partitioned model, a user may choose on
whim which of the servers that are being tested to use. They can
move back and forth in case of problems.
Rosenberg & Houri Expires August 24, 2008 [Page 16]
Internet-Draft Intra-Domain Presence Federation February 2008
o An enterprise is currently using servers from one vendor, but has
decided to add a second. They would like to gradually migrate
users from one to the other. In order to make a smooth
transition, users can move back and forth over a period of a few
weeks until they are finally required to stop going back, and get
deleted from their old system.
o A domain is using multiple clusters from the same vendor. To
simplify administration, users can connect to any of the clusters,
perhaps one local to their site. To accomplish this, the clusters
are connected using exclusive federation.
6.1. Routing
Due to its nature, routing in the Exclusive federation model is more
complex than the routing in the partitioned model.
Association of a user to a server can not be known until the user
publishes a presence document to a specific server or registers to
that server. Therefore, when Alice subscribes to Bob's presence
information, the server that serves the subscription can not know on
which server Bob's presence information may be published.
In addition, a server may get a subscription to a user but the user
may not be in any server yet. The server should respond with empty
notify and wait for the user to appear in one of the servers. Once
the user appears in one of the servers, the server should send the
subscription to that server.
A user may use two servers at the same time and have hers/his
presence information on two servers. This should be regarded as a
conflict and one of the presence clients should be terminated or
redirected to the other server.
Fortunately, most of the routing approaches described for partitioned
federation, excepting provisioned routing, can be adapted for
exclusive federation.
6.1.1. Centralized Database
A centralized database can be used, but will need to support a test-
and-set functionality. With it, servers can check if a user is
already in a specific server and set the user to the server if the
user is not on another server. If the user is already on another
server a redirect (or some other error message) will be sent to that
user.
Rosenberg & Houri Expires August 24, 2008 [Page 17]
Internet-Draft Intra-Domain Presence Federation February 2008
6.1.2. Routing Proxy
The routing proxy mechanism can be used. However, it requires
signaling from each presence server to the routing proxy to indicate
that the user is now located on that server. This can be done by
having each server send a REGISTER request to the routing proxy, for
that user, and setting the contact to itself. The routing proxy
would have a rule which requires only a single registered contact per
user. Using the registration event package [RFC3680], each presence
server subscribes to the registration state for each user it is
managing. If the routing proxy sees a duplicate registration, it
allows it and then uses a reg-event notification to the other
presence server to de-register the user.
6.1.3. Subdomaining
Subdomaining is just a variation on the centralized database.
Assuming the database supports a test-and-set mechanism, it can be
used for exclusive federation.
6.1.4. Peer-to-Peer
Peer-to-peer routing is particularly well suited for exclusive
federation. Essentially, it provides a distributed registrar
function that maps each AoR to the particular server that they are
currently registered against. When a UA registers to a particular
server, that registration is written into the P2P network, such that
queries for that user are directed to that presence server.
6.1.5. Forking
When a subscription is received by a server and the server does not
already know that it serves the user, the server will fork the
subscription request to all the servers. If a response is not
received in a certain timeout then the server will know that the user
is not served by any server yet and should keep the subscription in
waiting until the user will appear in one of the servers.
In order to enable the servers that now have a "subscription in
waiting" to the user to know that the user is now available in one of
the servers, there should be some broadcast or subscription mechanism
between the servers that will enable those servers to know about the
appearance of the user in one of the servers. This can be done using
the registration event package.
Rosenberg & Houri Expires August 24, 2008 [Page 18]
Internet-Draft Intra-Domain Presence Federation February 2008
6.2. Policy
In the exclusive federation model, policy becomes more complicated.
In the partitioned model, a user had their presence managed by the
same server all of the time. Thus, their policy can be provisioned
and excecuted there. With exclusive federation, a user can freely
move back and forth between servers. Consequently, their presence
will be managed by only a single server at one time, but that server
can change.
The simplest solution is just to require the user to separately
provision and manage policies on each server. In many of the use
cases above, exclusive federation is a transient situation that
eventually settles into partitioned federation. Thus, it may not be
unreasonable to require the user to manage both policies during the
transition. It is also possible that each server provides different
capabilities, and thus a user will receive different service
depending on which server they are connected to. Again, this may be
an acceptable limitation for the use cases it supports.
6.3. Presence Data
As with the partitioned model, in the exclusive model, the presence
data for a user resides on a single server at any given time. This
server owns all composition policies and procedures for collecting
and distributing presence data.
7. Unioned
In the unioned model, each user is actually served by more than one
presence server. In this case, "served" implies two properties:
o A user is served by a server when that user is provisioned on that
server, and
o That server is authoritative for some piece of presence state
associated with that user
In essence, in the unioned model, a user's presence data is
distributed across many presence servers, while in the partitioned
and exclusive models, its centralized in a single presence server.
Furthermore, it is possible that the user is provisioned with
different identifiers on each server.
This definition speaks specifically to ownership of presence data as
the key property. This rules out several cases which involve a mix
of servers within the enterprise, but do not constitute intra-domain
Rosenberg & Houri Expires August 24, 2008 [Page 19]
Internet-Draft Intra-Domain Presence Federation February 2008
unioned federation:
o A user utilizes an outbound SIP proxy from one vendor, which
connects to a presence server from another vendor. Even though
this will result in presence subscriptions and notifications
flowing between servers, and the user is potentially provisioned
on both, there is no authoritative presence state in the outbound
proxy, and so this is not intra-domain federation.
o A user utilizes a Resource List Server (RLS) from one vendor,
which holds their buddy list, and accesses presence data from a
presence server from another vendor. This case is actually the
partitioned case, not the unioned case. Effectively, the buddy
list itself is another "user", and it exists entirely on one
server (the RLS), while the actual users on the buddy list exist
entirely within another. Consequently, this case does not have
the property that a single presence resource exists on multiple
servers at the same time.
o A user subscribes to the presence of a presentity. This
subscription is first passed to their presence server, which acts
as a proxy, and instead sends the subscription to the UA of the
user, which acts as a presence edge server. In this model, it may
appear as if there are two presence servers for the user (the
actual server and their UA). However, the server is acting as a
proxy in this case. There is only one source of presence
information.
The unioned models arise naturally when a user is using devices from
different vendors, each of which has their own respective servers, or
when a user is using different servers for different parts of their
presence state. For example, Figure 6 shows the case where a single
user has a mobile client connected to presence server one and a
desktop client connected to presence server two.
Rosenberg & Houri Expires August 24, 2008 [Page 20]
Internet-Draft Intra-Domain Presence Federation February 2008
alice@example.com alice@example.com
+------------+ +------------+
| | | |
| Presence | | Presence |
| Server |--------------| Server |
| 1 | | 2 |
| | | |
| | | |
+------------+ +------------+
\ /
\ /
\ /
\ /
\ /
\ /
\...................../.......
\ / .
.\ / .
. \ | +--------+ .
. | |+------+| .
. +---+ || || .
. |+-+| || || .
. |+-+| |+------+| .
. | | +--------+ .
. | | /------ / .
. +---+ /------ / .
. --------/ .
. .
.............................
Alice
Figure 6: Unioned Case 1
As another example, a user may have two devices from the same vendor,
both of which are asociated with a single presence server, but that
presence server has incomplete presence state about the user.
Another presence server in the enterprise, due to its access to state
for that user, has additional data which needs to be accessed by the
first presence server in order to provide a comprehensive view of
presence data. This is shown in Figure 7.
Rosenberg & Houri Expires August 24, 2008 [Page 21]
Internet-Draft Intra-Domain Presence Federation February 2008
alice@example.com alice@example.com
+------------+ +------------+
| | | |
| Presence | | Presence |
| Server |--------------| Server |
| 1 | | 2 |
| | | |
| | | |
+------------+ +------------+
^ | |
| | |
| | |
///-------\\\ | |
||| specialized ||| | |
|| state || | |
\\\-------/// | |
.............................
. | | .
. | | +--------+ .
. | |+------+| .
. +---+ || || .
. |+-+| || || .
. |+-+| |+------+| .
. | | +--------+ .
. | | /------ / .
. +---+ /------ / .
. --------/ .
. .
. .
.............................
Alice
Figure 7: Unioned Case 2
Another use case for unioned federation are subscriber moves.
Consider a domain which uses multiple presence servers, typically
running in a partitioned configuration. The servers are organized
regionally so that each user is served by a presence server handling
their region. A user is moving from one region to a new job in
another, while retaining their SIP URI. In order to provide a smooth
transition, ideally the system would provide a "make before break"
functionality, allowing the user to be added onto the new server
prior to being removed from the old. During the transition period,
especially if the user had multiple clients to be moved, they can end
up with presence state existing on both servers at the same time.
Another use case for unioned federation is multiple providers.
Rosenberg & Houri Expires August 24, 2008 [Page 22]
Internet-Draft Intra-Domain Presence Federation February 2008
Consider a user in an enterprise, alice@example.com. Example.com has
a presence server deployed for all of its users. In addition, Alice
uses a public IM and presence provider. Alice would like that users
who connect to the public provider see presence state that comes from
example.com, and vice-a-versa. Interestingly, this use case isn't
intra-domain federation at all, but rather, unioned inter-domain
federation.
7.1. Hierarchical Model
The unioned intra-federation model can be realized in one of two ways
- using a hierarchical structure or a peer structure.
In the hierarchical model, presence subscriptions for the presentity
in question are always routed first to one of the servers - the root
- and then the root presence server subscribes to the next layer of
presence servers (which may, in turn, subscribe to the presence state
in other presence servers). Each presence server composes the
presence information it receives from its children, applying local
authorization and composition policies, and then passes the results
up to the higher layer. This is shown in Figure 8.
Rosenberg & Houri Expires August 24, 2008 [Page 23]
Internet-Draft Intra-Domain Presence Federation February 2008
+-----------+
*-----------* | |
|Auth and |---->| Presence | <--- root
|Composition| | Server |
*-----------* | |
| |
+-----------+
/ ---
/ ----
/ ----
/ ----
V -V
+-----------+ +-----------+
| | | |
*-----------* | Presence | *-----------* | Presence |
|Auth and |-->| Server | |Auth and |-->| Server |
|Composition| | | |Composition| | |
*-----------* | | *-----------* | |
+-----------+ +-----------+
| ---
| -----
| -----
| -----
| -----
| -----
V --V
+-----------+ +-----------+
| | | |
*-----------* | Presence | *-----------* | Presence |
|Auth and |-->| Server | |Auth and |-->| Server |
|Composition| | | |Composition| | |
*-----------* | | *-----------* | |
+-----------+ +-----------+
Figure 8: Hierarchical Model
Its important to note that this hierarchy defines the sequence of
presence composition and policy application, and does not imply a
literal message flow. As an example, consider once more the use case
of Figure 6. Assume that presence server 1 is the root, and presence
server 2 is its child. When Bob's PC subscribes to Bob's buddy list
(on presence server 2), that subscription will first go to presence
server 2. However, that presence server knows that it is not the
root in the hierarchy, and despite the fact that it has presence
state for Alice (who is on Bob's buddy list), it creates a back-end
subscription to presence server 1. Presence server 1, as the root,
subscribes to Alice's state at presence server 2. Now, since this
subscription came from presence server 1 and not Bob directly,
Rosenberg & Houri Expires August 24, 2008 [Page 24]
Internet-Draft Intra-Domain Presence Federation February 2008
presence server 2 provides the presence state. This is received at
presence server 1, which composes the data with its own state for
Alice, and then provides the results back to presence server 2,
which, having acted as an RLS, forwards the results back to Bob.
Consequently, this flow, as a message sequence diagram, involves
notifications passing from presence server 2, to server 1, back to
server 2. However, in terms of composition and policy, it was done
first at the child node (presence server 2), and then those results
used at the parent node (presence server 1).
7.1.1. Routing
In the hierarchical model, each presence server needs to be
provisioned with the root, its parent and its children presence
servers for each presentity it handles. These relationships could in
fact be different on a presentity-by-presentity basis; however, this
is complex to manage. In all likelihood, the parent and child
relationships are identical for each presentities. The overall
routing algorithm can be described thusly:
o If a SUBCRIBE is received from the parent node for this
presentity, perform subscriptions to each child node for this
presentity, and then take the results, apply composition and
authorization policies, and propagate to the parent.
o If a SUBSCRIBE is received from a node that is not the parent node
for this presentity, proxy the SUBSCRIBE to the parent node. This
includes cases where the node that sent the SUBSCRIBE is a child
node.
This routing rule is relatively simple, and in a two-server system is
almost trivial to provision. Interestingly, it works in cases where
some users are partitioned and some are unioned. When the users are
partitioned, this routing algorithm devolves into the forking
algorithm of Section 5.2.5. This points to the forking algorithm as
the a good choice since it can be used for both partitioned and
unioned.
An important property of the routing in the hierarchical model is
that the sequence of composition and policy operations are identical
for all watchers to that presentity, regardless of which presence
server they are associated with. The result is that the overall
presence state provided to a watcher is always consistent and
independent of the server the watcher is connected to. We call this
property the *consistency property*, and it is an important metric in
assessing the correctness of a federated presence system.
Rosenberg & Houri Expires August 24, 2008 [Page 25]
Internet-Draft Intra-Domain Presence Federation February 2008
7.1.2. Policy and Identity
Policy and identity are a clear challenge in the unioned model.
Firstly, since a user is provisioned on many servers, it is possible
that the identifier they utilize could be different on each server.
For example, on server 1, they could be joe@example.com, whereas on
server 2, they are joe.smith@example.com. In cases where the
identifiers are not equivalent, a mapping function needs to be
provisioned. This ideally happens on the server performing the back-
end subscription.
Secondly, the unioned model will result in back-end subscriptions
extending from one presence server to another presence server. These
subscriptions, though made by the presence server, need to be made
on-behalf-of the user that originally requested the presence state of
the presentity. Since the presence server extending the back-end
subscription will not often have credentials to claim identity of the
watcher, asserted identity using techniques like P-Asserted-ID
[RFC3325] are required, along with the associated trust relationships
between servers. Optimizations, such as view sharing
[I-D.rosenberg-simple-view-sharing] can help improve performance.
The principle challenge in a unioned presence model is policy,
including both authorization and composition policies. There are
three potential solutions to the administration of policy in the
hierarchical model (only two of which apply in the peer model, as
we'll discuss below. These are root-only, distributed provisioned,
and central provisioned.
7.1.2.1. Root Only
In the root-only policy model, authorization policy and composition
policy are applied only at the root of the tree. This is shown in
Figure 9.
Rosenberg & Houri Expires August 24, 2008 [Page 26]
Internet-Draft Intra-Domain Presence Federation February 2008
+-----------+
*-----------* | |
|Auth and |---->| Presence | <--- root
|Composition| | Server |
*-----------* | |
| |
+-----------+
/ ---
/ ----
/ ----
/ ----
V -V
+-----------+ +-----------+
| | | |
| Presence | | Presence |
| Server | | Server |
| | | |
| | | |
+-----------+ +-----------+
| ---
| -----
| -----
| -----
| -----
| -----
V --V
+-----------+ +-----------+
| | | |
| Presence | | Presence |
| Server | | Server |
| | | |
| | | |
+-----------+ +-----------+
Figure 9: Root Only
As long as the subscription request came from its parent, every child
presence server would automatically accept the subscription, and
provide notifications containing the full presence state it is aware
of. Any composition performed by a child presence server would need
to be lossless, in that it fully combines the source data without
loss of information, and also be done without any per-user
provisioning or configuration, operating in a default or
administrator-provisioned mode of operation.
The root-only model has the benefit that it requires the user to
provision policy in a single place (the root). However, it has the
drawback that the composition and policy processing may be performed
Rosenberg & Houri Expires August 24, 2008 [Page 27]
Internet-Draft Intra-Domain Presence Federation February 2008
very poorly. Presumably, there are multiple presence servers in the
first place because each of them has a particular speciality. That
speciality may be lost in the root-only model. For example, if a
child server provides geolocation information, the root presence
server may not have sufficient authorization policy capabilities to
allow the user to manage how that geolocation information is provided
to watchers.
7.1.2.2. Distributed Provisioning
The distributed provisioned model looks exactly like the diagram of
Figure 8. Each presence server is separately provisioned with its
own policies, including what users are allowed to watch, what
presence data they will get, and how it will be composed.
One immediate concern is whether the overall policy processing, when
performed independently at each server, is consistent, sane, and
provides reasonable degrees of privacy. It turns out that it can, if
some guidelines are followed.
Firstly, consider basic "yes/no" authorization policies. Lets say a
presentity, Alice, provides an authorization policy in server 1 where
Bob can see her presence, but on server 2, provides a policy where
Bob cannot. If presence server 1 is the root, the subscription is
accepted there, but the back-end subscription to presence server 2
would be rejected. As long as presence server 1 then rejects the
subscription, the system provides the correct behavior. This can be
turned into a more general rule:
o To guarantee privacy safety, if the back-end subscription
generated by a presence server is denied, that server must deny
the triggering subscription in turn, regardless of its own
authorization policies. This means that a presence server cannot
send notifications on its own until it has confirmed subscriptions
from downstream servers.
Things get more complicated when one considers authorization policies
whose job is to block access to specific pieces of information, as
opposed to blocking a user completely. For example, lets say Alice
wants to allow Bob to see her presence, but not her geolocation
information. She provisions a rule on server 1 that blocks
geolocation information, but grants it on server 2. The correct mode
of operation in this case is that the overall system will block
geolocation from Bob. But will it? In fact, it will, if a few
additional guidelines are followed:
o If a presence server adds any information to a presence document
beyond the information received from its children, it must provide
Rosenberg & Houri Expires August 24, 2008 [Page 28]
Internet-Draft Intra-Domain Presence Federation February 2008
authorization policies that govern the access to that information.
o If a presence server does not understand a piece of presence data
provided by its child, it should not attempt to apply its own
authorization policies to access of that information.
o A presence server should not add information to a presence
document that overlaps with information that can be added by its
parent. Of course, it is very hard for a presence server to know
whether this information overlaps. Consequently, provisioned
composition rules will be required to realize this.
If these rules are followed, the overall system provides privacy
safety and the overall policy applied is reasonable. This is because
these rules effectively segment the application of policy based on
specific data, to the servers that own the corresponding data. For
example, consider once more the geolocation use case described above,
and assume server 2 is the root. If server 1 has access to, and
provides geolocation information in presence documents it produces,
then server 1 would be the only one to provide authorization policies
governing geolocation. Server 2 would receive presence documents
from server 1 containing (or not) geolocation, but since it doesn't
provide or control geolocation, it lets that information pass
through. Thus, the overall presence document provided to the watcher
will contain gelocation if Alice wanted it to, and not otherwise, and
the controls for access to geolocation would exist only on server 1.
The second major concern on distributed provisioning is that it is
confusing for users. However, in the model that is described here,
each server would necessarily be providing distinct rules, governing
the information it uniquely provides. Thus, server 2 would have
rules about who is allowed to see geolocation, and server 1 would
have rules about who is allowed to subscribe overall. Though not
ideal, there is certainly precedent for users configuring policies on
different servers based on the differing services provided by those
servers. Users today provision block and allow lists in email for
access to email servers, and separately in IM and presence
applications for access to IM.
7.1.2.3. Central Provisioning
The central provisioning model is a hybrid between root-only and
distributed provisioning. Each server does in fact execute its own
authorization and composition policies. However, rather than the
user provisioning them independently in each place, there is some
kind of central portal where the user provisions the rules, and that
portal generates policies for each specific server based on the data
that the corresponding server provides. This is shown in Figure 10.
Rosenberg & Houri Expires August 24, 2008 [Page 29]
Internet-Draft Intra-Domain Presence Federation February 2008
+---------------------+
|provisioning portal |
+---------------------+
. . . . .
. . . . .
. . . . .......................
........................... . . . .
. . . . .
. . . . .
. ........................... . ............. .
. . . . .
. . ...................... . .
. . V +-----------+ . .
. . *-----------* | | . .
. . |Auth and |---->| Presence | <--- root . .
. . |Composition| | Server | . .
. . *-----------* | | . .
. . | | . .
. . +-----------+ . .
. . | ---- . .
. . | ------- . .
. . | ------- .
. . | .------- .
. . V . ---V V
. . +-----------+ . +-----------+
. . | | V | |
. . *-----------* | Presence | *-----------* | Presence |
. ....>|Auth and |-->| Server | |Auth and |-->| Server |
. |Composition| | | |Composition| | |
. *-----------* | | *-----------* | |
. +-----------+ +-----------+
. / --
. / ----
. / ---
. / ----
. / ---
. / ----
. V -V
. +-----------+ +-----------+
V | | | |
*-----------* | Presence | *-----------* | Presence |
|Auth and |-->| Server | |Auth and |-->| Server |
|Composition| | | |Composition| | |
*-----------* | | *-----------* | |
+-----------+ +-----------+
Figure 10: Central Provisioning
Rosenberg & Houri Expires August 24, 2008 [Page 30]
Internet-Draft Intra-Domain Presence Federation February 2008
Centralized provisioning brings the benefits of root-only (single
point of user provisioning) with those of distributed provisioning
(utilize full capabilities of all servers). Its principle drawback
is that it requires another component - the portal - which can
represent the union of the authorization policies supported by each
server, and then delegate those policies to each corresponding
server.
For both the centralized and distributed provisioning approaches, the
hierarchical model suffers overall from the fact that the root of the
policy processing may not be tuned to the specific policy needs of
the device that has subscribed. For example, in the use case of
Figure 6, presence server 1 may be providing composition policies
tuned to the fact that the device is wireless with limited display.
Consequently, when Bob subscribes from his mobile device, is presence
server 2 is the root, presence server 2 may add additional data and
provide an overall presence document to the client which is not
optimized for that device. This problem is one of the principal
motivations for the peer model, described below.
7.1.3. Presence Data
The hierarhical model is based on the idea that each presence server
in the chain contributes some unique piece of presence information,
composing it with what it receives from its child, and passing it on.
For the overall presence document to be reasonable, several
guidelines need to be followed:
o A presence server must be prepared to receive documents from its
peer containing information that it does not understand, and to
apply unioned composition policies that retain this information,
adding to it the unique information it wishes to contribute.
o A user interface rendering some presence document provided by its
presence server must be prepared for any kind of presence document
compliant to the presence data model, and must not assume a
specific structure based on the limitations and implementation
choices of the server to which it is paired.
If these basic rules are followed, the overall system provides
functionality equivalent to the combination of the presence
capabilities of the servers contained within it, which is highly
desirable.
7.2. Peer Model
In the peer model, there is no one root. When a watcher subscribes
to a presentity, that subscription is processed first by the server
Rosenberg & Houri Expires August 24, 2008 [Page 31]
Internet-Draft Intra-Domain Presence Federation February 2008
to which the watcher is connected (effectively acting as the root),
and then the subscription is passed to other child presence servers.
In essence, in the peer model, there is a per-watcher hierarchy, with
the root being a function of the watcher. Consider the use case in
Figure 6 If Bob has his buddy list on presence server 1, and it
contains Alice, presence server 1 acts as the root, and then performs
a back-end subscription to presence server 2. However, if Joe has
his buddy list on presence server 2, and his buddy list contains
Alice, presence server 2 acts as the root, and performs a back-end
subscription to presence server 1. This is shown in Figure 11.
alice@example.com alice@example.com
+------------+ +------------+
| |<-------------| |<--------+
SUB | Presence | | Presence | |
List w/| Server | | Server | SUB |
Alice | 1 | | 2 | List w/|
+---->| |------------->| | Alice |
| | | | | |
| +------------+ +------------+ |
| \ / |
| \ / |
| \ / |
| \ / |
| \ / |
| \ / |
...|........ \...................../....... .........|........
. . \ / . . .
. . .\ / . . +--------+ .
. | . . \ | +--------+ . . |+------+| .
. | . . | |+------+| . . || || .
. +---+ . . +---+ || || . . || || .
. |+-+| . . |+-+| || || . . |+------+| .
. |+-+| . . |+-+| |+------+| . . +--------+ .
. | | . . | | +--------+ . . /------ / .
. | | . . | | /------ / . . /------ / .
. +---+ . . +---+ /------ / . . --------/ .
. . . --------/ . . .
. . . . . .
............ ............................. ..................
Bob Alice Joe
Figure 11: Peer Model
Rosenberg & Houri Expires August 24, 2008 [Page 32]
Internet-Draft Intra-Domain Presence Federation February 2008
Whereas the hierarchical model clearly provides the consistency
property, it is not obvious whether a particular deployment of the
peer model provides the consistency property. It ends up being a
function of the composition policies of the individual servers. If
Pi() represents the composition and authorization policies of server
i, and takes as input one or more presence documents provided by its
children, and outputs a presence document, the overall system
provides consistency when:
Pi(Pj()) = Pj(Pi())
which is effectively the commutativity property.
7.2.1. Routing
Routing in the peer model works similarly to the hierarchical model.
Each presence server would be configured with the children it has
when it acts as the root. The overall routing algorithm then works
as follows:
o If a presence server receives a subscription for a presentity from
a particular watcher, and it already has a different subscription
(as identified by dialog identifiers) for that presentity from
that watcher, it rejects the second subscription with an
indication of a loop. This algorithm does rule out the
possibility of two instances of the same watcher subscribing to
the same presentity.
o If a presence server receives a subscription for a presentity from
a watcher and it doesn't have one yet for that pair, it processes
it and generates back end subscriptions to each configured child.
If a back-end subscription generates an error due to loop, it
proceeds without that back-end input.
For example, consider Bob subscribing to Alice. Bob's client is
supported by server 1. Server 1 has not seen this subscription
before, so it acts as the root and passes it to server 2. Server 2
hasn't seen it before, so it accepts it (now acting as the child),
and sends the subscription to ITS child, which is server 1. Server 1
has already seen the subscription, so it rejects it. Now server 2
basically knows its the child, and so it generates documents with
just its own data.
As in the hierarchical case, it is possible to intermix partitioned
and peer models for different users. In the partitioned case, the
routing for hierarchical devolves into the forking routing described
in Section 5.2.5. However, intermixing peer and exclusive federation
Rosenberg & Houri Expires August 24, 2008 [Page 33]
Internet-Draft Intra-Domain Presence Federation February 2008
for different users is challenging. [[OPEN ISSUE: need to think
about this more.]]
7.2.2. Policy
The policy considerations for the peer model are very similar to
those of the hierarchical model. However, the root-only policy
approach is non-sensical in the peer model, and cannot be utilized.
The distributed and centralized provisioning approaches apply, and
the rules described above for generating correct results provide
correct results in the peer model as well.
In addition, the policy processing in the peer model eliminates the
problem described in Section 7.1.2.3. The problem is that
composition and authorization policies may be tuned to the needs of
the specific device that is connected. In the hierarchical model,
the wrong server for a particular device may be at the root, and the
resulting presence document poorly suited to the consuming device.
This problem is alleviated in the peer model. The server that is
paired or tuned for that particular user or device is always at the
root of the tree, and its composition policies have the final say in
how presence data is presented to the watcher on that device.
7.2.3. Presence Data
The considerations for presence data and composition in the
hierarchical model apply in the peer model as well. The principle
issue is consistency, and whether the overall presence document for a
watcher is the same regardless of which server the watcher connects
from. As mentioned above, consistency is a property of commutativity
of composition, which may or may not be true depending on the
implementation.
Interestingly, in the use case of Figure 7, a particular user only
ever has devices on a single server, and thus the peer and
hierarchical models end up being the same, and consistency is
provided.
8. Summary
This document doesn't make any recommendation as to which models is
best. Each model has different areas of applicability and are
appropriate in a particular deployment.
Rosenberg & Houri Expires August 24, 2008 [Page 34]
Internet-Draft Intra-Domain Presence Federation February 2008
9. Future Considerations
There are some additional concepts that can be considered, which have
not yet been explored. One of them is routing of PUBLISH requests
between systems. This can be used as part of the unioned models and
requires further discussion.
It is also worth considering IM in these different models. For
example, the issues for routing IM (and any session in general) are
identical to presence routing. Perhaps a separate document.
Another big issue is data federation. For the unioned models in
particular, there is typically a desire to be able to add a buddy on
one system and have it appear on another, or to add a user to a
whitelist on one system and have that reflect in the other. This
requires some kind of standardized data interfaces and is for further
consideration.
10. Acknowledgements
The author would like to thank Paul Fullarton, David Williams, Sanjay
Sinha, and Paul Kyzivat for their comments.
11. Security Considerations
The principle issue in intra-domain federation is that of privacy.
It is important that the system meets user expectations, and even in
cases of user provisioning errors or inconsistencies, it provides
appropriate levels of privacy. This is an issue in the unioned
models, where user privacy policies can exist on multiple servers at
the same time. The guidelines described here for authorization
policies help ensure that privacy properties are maintained.
12. IANA Considerations
There are no IANA considerations associated with this specification.
13. Informative References
[RFC2778] Day, M., Rosenberg, J., and H. Sugano, "A Model for
Presence and Instant Messaging", RFC 2778, February 2000.
[RFC3863] Sugano, H., Fujimoto, S., Klyne, G., Bateman, A., Carr,
W., and J. Peterson, "Presence Information Data Format
Rosenberg & Houri Expires August 24, 2008 [Page 35]
Internet-Draft Intra-Domain Presence Federation February 2008
(PIDF)", RFC 3863, August 2004.
[RFC4479] Rosenberg, J., "A Data Model for Presence", RFC 4479,
July 2006.
[RFC3856] Rosenberg, J., "A Presence Event Package for the Session
Initiation Protocol (SIP)", RFC 3856, August 2004.
[RFC4662] Roach, A., Campbell, B., and J. Rosenberg, "A Session
Initiation Protocol (SIP) Event Notification Extension for
Resource Lists", RFC 4662, August 2006.
[RFC3944] Johnson, T., Okubo, S., and S. Campos, "H.350 Directory
Services", RFC 3944, December 2004.
[RFC3325] Jennings, C., Peterson, J., and M. Watson, "Private
Extensions to the Session Initiation Protocol (SIP) for
Asserted Identity within Trusted Networks", RFC 3325,
November 2002.
[RFC3680] Rosenberg, J., "A Session Initiation Protocol (SIP) Event
Package for Registrations", RFC 3680, March 2004.
[I-D.ietf-speermint-consolidated-presence-im-usecases]
Houri, A., "Presence & Instant Messaging Peering Use
Cases",
draft-ietf-speermint-consolidated-presence-im-usecases-03
(work in progress), November 2007.
[I-D.rosenberg-simple-view-sharing]
Rosenberg, J., Donovan, S., and K. McMurry, "Optimizing
Federated Presence with View Sharing",
draft-rosenberg-simple-view-sharing-00 (work in progress),
November 2007.
Authors' Addresses
Jonathan Rosenberg
Cisco
Edison, NJ
US
Phone: +1 973 952-5000
Email: jdrosen@cisco.com
URI: http://www.jdrosen.net
Rosenberg & Houri Expires August 24, 2008 [Page 36]
Internet-Draft Intra-Domain Presence Federation February 2008
Avshalom Houri
IBM
Science Park, Rehovot
Israel
Email: avshalom@il.ibm.com
Rosenberg & Houri Expires August 24, 2008 [Page 37]
Internet-Draft Intra-Domain Presence Federation February 2008
Full Copyright Statement
Copyright (C) The IETF Trust (2008).
This document is subject to the rights, licenses and restrictions
contained in BCP 78, and except as set forth therein, the authors
retain all their rights.
This document and the information contained herein are provided on an
"AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND
THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS
OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF
THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property
The IETF takes no position regarding the validity or scope of any
Intellectual Property Rights or other rights that might be claimed to
pertain to the implementation or use of the technology described in
this document or the extent to which any license under such rights
might or might not be available; nor does it represent that it has
made any independent effort to identify any such rights. Information
on the procedures with respect to rights in RFC documents can be
found in BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat and any
assurances of licenses to be made available, or the result of an
attempt made to obtain a general license or permission for the use of
such proprietary rights by implementers or users of this
specification can be obtained from the IETF on-line IPR repository at
http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any
copyrights, patents or patent applications, or other proprietary
rights that may cover technology that may be required to implement
this standard. Please address the information to the IETF at
ietf-ipr@ietf.org.
Acknowledgment
Funding for the RFC Editor function is provided by the IETF
Administrative Support Activity (IASA).
Rosenberg & Houri Expires August 24, 2008 [Page 38]
