Subject: [OAUTH-WG] oauth saml bindings

From: Leif Johansson <[email-masked]>
Date: Wed, 29 Jul 2009 15:31:48 +0200

Another topic that came up at the bar-BOF this morning was extensions (and 
use-cases) for sending attributes along with an OAuth authentication. After
some discussion the room agreed that if such a thing was going to be attempted
it should probably use existing attribute infrastructure, eg SAML. 

Hence the subject - SAML bindings for OAuth, that is a specification of how to 
send (certain types of) SAML protocol messages "over", or along side, OAuth.

I'll provide a very simple use-case to show that this at least isn't just an 
academic exercise.

Imagine using OAuth for some type of virtual worlds (aka grid) service where
the user is first authenticated using a browser-based SSO (eg SAML WebSSO
or OpenID 2.0) that supports asserting attributes about the user from the IdP
to the relying party (application).

The virtual worlds protocol runs over HTTP and the virtual world client 
application (which isn't the browser!) uses OAuth to authenticate to the 
virtual world server in order to operate on the protected resources that are 
the users objects in the world.

During initial authentication (the WebSSO bit) the identity provider issues a
SAML attribute assertion encrypted to the (key of the) virtual worlds server
containing information about the user known to the IdP but not (a priori)
known to the virtual worlds server (it can even be protected from the user).

The browser doesn't communicate with the virtual worlds server, only the 
virtual worlds client does that but we need a way for the assertion to reach 
the virtual worlds server tied to the resource authentication.

	Cheers Leif