Subject: [abfab] I-D Action: draft-ietf-abfab-aaa-saml-08.txt

From: [email-masked]
Date: Thu, 07 Nov 2013 12:35:18 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Application Bridging for Federated Access Beyond web Working Group of the IETF.

	Title           : A RADIUS Attribute, Binding, Profiles, Name Identifier Format, and Confirmation Methods for SAML
	Author(s)       : Josh Howlett
                          Sam Hartman
	Filename        : draft-ietf-abfab-aaa-saml-08.txt
	Pages           : 24
	Date            : 2013-11-07

Abstract:
   This document describes the use of the Security Assertion Mark-up
   Language (SAML) with RADIUS in the context of the ABFAB architecture.
   It defines two RADIUS attributes, a SAML binding, a SAML name
   identifier format, two SAML profiles, and two SAML confirmation
   methods.  The RADIUS attributes permit encapsulation of SAML
   assertions and protocol messages within RADIUS, allowing SAML
   entities to communicate using the binding.  The two profiles describe
   the application of this binding for ABFAB authentication and
   assertion query/request, enabling a Relying Party to request
   authentication of, or assertions for, user or machine principals.
   These principals may be named using an NAI name identifier format.
   Finally, the subject confirmation methods allow requests and queries
   to be issued for a previously authenticated user or machine without
   needing to explicitly identify them as the subject.  These artifacts
   have been defined to permit application in AAA scenarios other than
   ABFAB, such as network access.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-abfab-aaa-saml

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-abfab-aaa-saml-08

A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=draft-ietf-abfab-aaa-saml-08

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Sam Hartman <[email-masked]>
Date: Thu, 07 Nov 2013 16:07:56 -0500

08   was published to address my comments that seemed to have obvious
solutions.

while I had the document open I took a first crack at privacy and
security considerations.

---

From: "Cantor, Scott" <[email-masked]>
Date: Mon, 11 Nov 2013 17:48:29 +0000

I reviewed the section 5 text that talks about the naming issue, so here's
my opinion based on that reading.

TL;DR, don't waste time overloading something already there, just define
what you need.

While I think there might be some tactical ways to do this on the SP side
along the lines of what I said in the Jabber room last Thursday, I think
ultimately you have a parallel problem on both ends that probably just
needs to be solved consistently.

In both cases, you have an entityID you're trying to evaluate in the
context of a realm, so I think you just need to define a metadata
extension to do that.

As we've discussed, yes this looks like Scope, and in many cases it will
be the same value, but that doesn't mean it's the same thing. That also
doesn't address the SP end.

There are two obvious choices here:

- an explicit extension element
- an entity attribute

I'm completely ambivalent about which you use. Specifying an entity
attribute is less work, but the XML is slightly more verbose in the end.
An advantage that is unlikely to be all that important but YMMV is that
defining a SAML Attribute for this allows the concept of the realm to be
expressed in other contexts in SAML, and using the EntityAttributes
extension means you can (but I doubt you would) actually embed a third
party attestation to the realm information in the form of an actual SAML
Assertion inside the metadata.

On the subject of whether you should/need to do this now, I think there
are other use cases for getting what amounts to a AAA "realm" mapped in
metadata. We should just do it.

-- Scott

---

From: Leif Johansson <[email-masked]>
Date: Mon, 11 Nov 2013 18:52:26 +0100

> metadata. We should just do it.
As an individual I'm all for an entity attribute. That also gives us the
impetus to finalize the entity category draft (http://macedir.org)
> -- Scott
>
>
> _______________________________________________
> abfab mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/abfab