Session Traversal Utilities for NAT (STUN) Extension for Third-Party Authorization
RFC 7635
Document | Type | RFC - Proposed Standard (August 2015; Errata) | |
---|---|---|---|
Authors | Tirumaleswar Reddy.K , Prashanth Patil , Ram R , Justin Uberti | ||
Last updated | 2016-10-12 | ||
Stream | IETF | ||
Formats | plain text html pdf htmlized bibtex | ||
Reviews | |||
Stream | WG state | Submitted to IESG for Publication | |
Document shepherd | Gonzalo Camarillo | ||
Shepherd write-up | Show (last changed 2015-01-15) | ||
IESG | IESG state | RFC 7635 (Proposed Standard) | |
Action Holders |
(None)
|
||
Consensus Boilerplate | Yes | ||
Telechat date | |||
Responsible AD | Spencer Dawkins | ||
Send notices to | (None) | ||
IANA | IANA review state | Version Changed - Review Needed | |
IANA action state | RFC-Ed-Ack |
Internet Engineering Task Force (IETF) T. Reddy Request for Comments: 7635 P. Patil Category: Standards Track R. Ravindranath ISSN: 2070-1721 Cisco J. Uberti Google August 2015 Session Traversal Utilities for NAT (STUN) Extension for Third-Party Authorization Abstract This document proposes the use of OAuth 2.0 to obtain and validate ephemeral tokens that can be used for Session Traversal Utilities for NAT (STUN) authentication. The usage of ephemeral tokens ensures that access to a STUN server can be controlled even if the tokens are compromised. Status of This Memo This is an Internet Standards Track document. This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Further information on Internet Standards is available in Section 2 of RFC 5741. Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at http://www.rfc-editor.org/info/rfc7635. Copyright Notice Copyright (c) 2015 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Reddy, et al. Standards Track [Page 1] RFC 7635 STUN for Third-Party Authorization August 2015 Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 3 3. Solution Overview . . . . . . . . . . . . . . . . . . . . . . 3 3.1. Usage with TURN . . . . . . . . . . . . . . . . . . . . . 4 4. Obtaining a Token Using OAuth . . . . . . . . . . . . . . . . 7 4.1. Key Establishment . . . . . . . . . . . . . . . . . . . . 8 4.1.1. HTTP Interactions . . . . . . . . . . . . . . . . . . 8 4.1.2. Manual Provisioning . . . . . . . . . . . . . . . . . 10 5. Forming a Request . . . . . . . . . . . . . . . . . . . . . . 10 6. STUN Attributes . . . . . . . . . . . . . . . . . . . . . . . 10 6.1. THIRD-PARTY-AUTHORIZATION . . . . . . . . . . . . . . . . 10 6.2. ACCESS-TOKEN . . . . . . . . . . . . . . . . . . . . . . 11 7. STUN Server Behavior . . . . . . . . . . . . . . . . . . . . 13 8. STUN Client Behavior . . . . . . . . . . . . . . . . . . . . 14 9. TURN Client and Server Behavior . . . . . . . . . . . . . . . 14 10. Operational Considerations . . . . . . . . . . . . . . . . . 15 11. Security Considerations . . . . . . . . . . . . . . . . . . . 15 12. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 16 12.1. Well-Known 'stun-key' URI . . . . . . . . . . . . . . . 16 13. References . . . . . . . . . . . . . . . . . . . . . . . . . 16 13.1. Normative References . . . . . . . . . . . . . . . . . . 16 13.2. Informative References . . . . . . . . . . . . . . . . . 17 Appendix A. Sample Tickets . . . . . . . . . . . . . . . . . . . 20 Appendix B. Interaction between the Client and Authorization Server . . . . . . . . . . . . . . . . . . . . . . . 22 Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . . 24 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 24 1. Introduction Session Traversal Utilities for NAT (STUN) [RFC5389] provides a mechanism to control access via 'long-term' username/password credentials that are provided as part of the STUN protocol. It is expected that these credentials will be kept secret; if the credentials are discovered, the STUN server could be used by unauthorized users or applications. However, in web applications like WebRTC [WEBRTC] where JavaScript uses the browser functionality for making real-time audio and/or video calls, web conferencing, and direct data transfer, ensuring this secrecy is typically not possible. To address this problem and the ones described in [RFC7376], thisShow full document text