1247616 - Support RFC 7635 (TURN OAuth)

Status: NEW

(Core :: WebRTC: Networking, enhancement, P3)

Description

[Maire Reavy [:mreavy]]

This is similar to the Chromium issue https://bugs.chromium.org/p/webrtc/issues/detail?id=4907

Initial analysis for prioritization: The key purpose of this is to allow short-lived access to TURN resources without having a tight binding between the web server and the TURN server. The fact that it’s using a different STUN attribute (than password) to communicate the access token is really protocol hygiene. It doesn’t make anything possible that wouldn’t otherwise be possible.  So early implementations can use the technique described in here, but with normal TURN passwords holding the tokens.

For this reason, we are putting this on our longer term roadmap, not our short-term roadmap.  If anyone feels this should be done on the short-term roadmap, please make the argument in this bug.

Comment 1

[Adam Roach [:abr]]

Until support for TURN OAuth is generally available in WebRTC browsers, implementors may wish to look at the technique described in https://tools.ietf.org/html/draft-uberti-behave-turn-rest-00 -- it requires no browser support, and only moderate coordination between the application (web) server and the TURN server.

Comment 2

[Bulk Bug Changes for mreavy's org]

Mass change P2->P3 to align with new Mozilla triage process.

Comment 3

[bakfitty]

I want to implement this feature..

To make it happen am I correct that I need

1. Add two new STUN attribute(THIRD-PARTY-AUTHORIZATION, ACCESS-TOKEN) for the token and some logic to handle properly OAuth negotiation with turn server in nICEr.
2. Extend nicerctx mtransport wrapper the NrIceTurnServer class and some logic in ToNicerTurnStruct function and in SetTurnServers function.
3. Some changes in peerconnection.jsm in validation

Am I missed any other place where I should make changes?

Thanks

Comment 4

[Alex Chronopoulos [:achronop]]

Byron, do you think you can give directions to Misi developing that feature?

Comment 5

[Byron Campen [:bwc]]

That seems like the right approach to me, although you will also need to update testing/web-platform/meta/webrtc/RTCConfiguration-iceServers.html.ini to stop expecting failures on some of the test-cases.

Comment 6

[bakfitty]

I have a working Prof of Concept code, that Authenticated successfully against coTURN server and relayed media traffic.
There is a bug on coTURN side that I need to fix.

I will clean the code and submit for a review hopefully in this month..

Many thanks for the help and guidance to Alex & Byron

Comment 7

[BugBot [:suhaib / :marco/ :calixte]]

The bug assignee didn't login in Bugzilla in the last 7 months.
:bwc, could you have a look please?
For more information, please visit auto_nag documentation.