Subject: [OAUTH-WG] Security Considerations (was draft-ietf-oauth-saml2-bearer-17)

From: Brian Campbell <[email-masked]>
Date: Mon, 4 Nov 2013 13:19:23 -0800

On Sat, Nov 2, 2013 at 2:07 AM, Hannes Tschofenig
<[email-masked]> wrote:
> Security Consideration section:
>
>
> I believe the section needs to say two things into addition to the reference
> to the other specifications, which are already included in the security
> consideration section:
>
> a) The specification does not mandate replay protection for the SAML
> assertion usage for neither the authorization grant nor for the client
> authentication. It is an optional feature.

Okay, I'll add some text about that. I think a word or two about it
should go into Interoperability Considerations as well.

> b) There is actually no authentication happening when these SAML assertions
> are used for client authentication and for the authorization grant (in the
> classical definition of authentication). This may be surprising to some why
> typically assume that the client would have to demonstrate proof of
> possession of a secret, which isn't the case here.

I'm not sure I fully understand what you mean. Maybe it's some
semantics around "authentication." Can you explain more or propose
some text?

> It would have been possible to provide more enhanced funtionality (and SAML
> supports this as well) but it is not provided in the specification. Maybe a
> future specification will provide that functionalility. I think it is worth pointing out.

Can you give some examples or propose some text?