# MESSAGE authorization rules

This document follows specification of authorization documents suggested by common_auth and defines a document format for storing rules for authorization of instant messages.

## Terms

##

sender

- User sending the instant message represented by URI present in From header field.

recipient

- User receiving the instant message represented by AOR/To URI.

## Instant message authorization documents

Instant message authorization document is XML document formatted according to the schema defined in common_auth. It inherits the MIME type of common policy documents defined there - application/auth-policy+xml.

All XML elements designed in this document belong to the urn:iptel:xml:ns:im-rules namespace.

This namespace breaks conventions mentioned in the document which was used as a source but it will stay here due to compatibility reasons if there will be no problems with it.

### Conditions

Conditions are processed according to the specification in common_auth.

#### Sphere

If the "instant messaging server" (proxy) trying to resolve authorization rules is bound together with the presence server it can take the sphere value from the presence server as defined in pres_auth, otherwise sphere value is considered undefined in terms of common policy processing.

### Actions

This document defines one action - <im-handling>. It is defined an enumerated integer type (like sub-handling in pres_auth). Possible values are:

###

block (value 0)

- The message should not be delivered to the user and should be rejected with a 403 Forbidden result code. This is the dafault value of im-handling.

allow (value 1)

- The message should be delivered to the destination user.

In the future these values may change.

If there are more matching rules, the resulting action will be the maximum of their <im-handling> values.

### Transformations

Transformations are not defined at this moment. In the future there can be for example length limitations or some flagging (like spam) or rate limitations.

## Example

    <?xml version="1.0"?>
    <ruleset xmlns="urn:ietf:params:xml:ns:common-policy"
    xmlns:im="urn:iptel:xml:ns:im-rules">
      <rule id="whitelist">
        <conditions>
          <identity>
            <id>sip:jan@example.com</id>
            <id>sip:pavel@example.com</id>
            <id>sip:vasek@example.com</id>
            <id>sip:ja@example.com</id>
          </identity>
        </conditions>
        <actions>
          <im:im-handling>allow</im:im-handling>
        </actions>
        <transformations/>
      </rule>
      <rule id="blacklist">
        <conditions>
          <identity>
            <id>sip:smith@example.com</id>
          </identity>
        </conditions>
        <actions>
          <im:im-handling>block</im:im-handling>
        </actions>
        <transformations/>
      </rule>
    </ruleset>

## Usage with XCAP

This document defines im-rules as unique application usage ID (AUID) required by XCAP specification.

### Naming conventions

When an instant message comes to a IM/presence server (proxy) within its domain, the server should look for document [xcap-root]/im-rules/users/[recipient username]/im-rules.xml and process rules in it.

There might be new versions of internet drafts and thus links to them my be obsolete. In such case try increment version in link or find the draft on IETF by name.

common auth

## draft-ietf-geopriv-common-policy-05.txt

presence auth

## draft-ietf-simple-presence-rules-03.txt - presence authorization XML based data format and usage with XCAP