Subject: [OAUTH-WG] AD Review of http://datatracker.ietf.org/doc/draft-ietf-oauth-saml2-bearer

From: Kathleen Moriarty <[email-masked]>
Date: Tue, 15 Jul 2014 16:04:08 -0400

Hello,

I just finished my review of
http://datatracker.ietf.org/doc/draft-ietf-oauth-saml2-bearer.  The draft
looks great, thank you for all of your efforts on it!

I did notice that there were no privacy considerations pointing back to
RFC6973, could that text be added?  The draft came after the Oauth
framework publication (refernced in the security considerations), so I am
guessing that is why this was missed as there are privacy considerations in
the oauth assertion draft (I competed that review as well and the draft
looked great.  I don't have any comments to add prior to progressing the
draft).

Thank you.

-- 

Best regards,
Kathleen

---

From: Brian Campbell <[email-masked]>
Date: Fri, 18 Jul 2014 23:00:50 -0600

How about the following (which is intentionally similar to the text I just
put forth for your request for privacy consideration in
draft-ietf-oauth-jwt-bearer-09)?

A SAML Assertion may contain privacy-sensitive information and, to prevent
disclosure of such information to unintended parties, should only be
transmitted over encrypted channels, such as TLS. In cases where it’s
desirable to prevent disclosure of certain information the client, the
Subject and/or individual attributes of a SAML Assertion may be encrypted
to the authorization server.

Deployments should determine the minimum amount of information necessary to
complete the exchange and include only that information in an Assertion
(typically by limiting what information is included in an
<AttributeStatement> or omitting it altogether). In some cases
the Subject can be a value representing an anonymous or pseudonymous user
as described in Section 6.3.1 of the Assertion Framework for OAuth 2.0
Client Authentication and Authorization Grants
[*http://tools.ietf.org/html/draft-ietf-oauth-assertions-16#section-6.3.1
<http://tools.ietf.org/html/draft-ietf-oauth-assertions-16#section-6.3.1>*].

On Tue, Jul 15, 2014 at 2:04 PM, Kathleen Moriarty <
[email-masked]> wrote:

> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>
>

---

From: Kathleen Moriarty <[email-masked]>
Date: Sat, 19 Jul 2014 10:24:06 -0400

Thanks for the quick response, Brian.  I think the text looks great.  The only change I'd like to suggest is in the second sentence, to change the 'may' to 'SHOULD'.

Best regards,
Kathleen 

Sent from my iPhone

> On Jul 19, 2014, at 1:00 AM, Brian Campbell <[email-masked]> wrote:
> 
> How about the following (which is intentionally similar to the text I just put forth for your request for privacy consideration in draft-ietf-oauth-jwt-bearer-09)?
> 
> A SAML Assertion may contain privacy-sensitive information and, to prevent disclosure of such information to unintended parties, should only be transmitted over encrypted channels, such as TLS. In cases where it’s desirable to prevent disclosure of certain information the client, the Subject and/or individual attributes of a SAML Assertion may be encrypted to the authorization server. 
> 
> Deployments should determine the minimum amount of information necessary to complete the exchange and include only that information in an Assertion (typically by limiting what information is included in an <AttributeStatement> or omitting it altogether). In some cases the Subject can be a value representing an anonymous or pseudonymous user as described in Section 6.3.1 of the Assertion Framework for OAuth 2.0 Client Authentication and Authorization Grants [http://tools.ietf.org/html/draft-ietf-oauth-assertions-16#section-6.3.1]. 
> 
> 
>> On Tue, Jul 15, 2014 at 2:04 PM, Kathleen Moriarty <[email-masked]> wrote:
>> Hello,
>> 
>> I just finished my review of http://datatracker.ietf.org/doc/draft-ietf-oauth-saml2-bearer.  The draft looks great, thank you for all of your efforts on it!
>> 
>> I did notice that there were no privacy considerations pointing back to RFC6973, could that text be added?  The draft came after the Oauth framework publication (refernced in the security considerations), so I am guessing that is why this was missed as there are privacy considerations in the oauth assertion draft (I competed that review as well and the draft looked great.  I don't have any comments to add prior to progressing the draft).
>> 
>> Thank you.
>> 
>> -- 
>> 
>> Best regards,
>> Kathleen
>>

---

From: Mike Jones <[email-masked]>
Date: Sat, 19 Jul 2014 16:00:25 +0000

I agree with Brian’s suggested text.  Thanks for writing this, Brian!

                                                            -- Mike

From: OAuth [mailto:[email-masked]] On Behalf Of Kathleen Moriarty
Sent: Saturday, July 19, 2014 7:24 AM
To: Brian Campbell
Cc: [email-masked]
Subject: Re: [OAUTH-WG] AD Review of http://datatracker.ietf.org/doc/draft-ietf-oauth-saml2-bearer

Best regards,
Kathleen

Sent from my iPhone

On Jul 19, 2014, at 1:00 AM, Brian Campbell <[email-masked]<mailto:[email-masked]>> wrote:
How about the following (which is intentionally similar to the text I just put forth for your request for privacy consideration in draft-ietf-oauth-jwt-bearer-09)?
A SAML Assertion may contain privacy-sensitive information and, to prevent disclosure of such information to unintended parties, should only be transmitted over encrypted channels, such as TLS. In cases where it’s desirable to prevent disclosure of certain information the client, the Subject and/or individual attributes of a SAML Assertion may be encrypted to the authorization server.

On Tue, Jul 15, 2014 at 2:04 PM, Kathleen Moriarty <[email-masked]<mailto:[email-masked]>> wrote:
Hello,

Thank you.

--

Best regards,
Kathleen

_______________________________________________
OAuth mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/oauth

---

From: Brian Campbell <[email-masked]>
Date: Sat, 19 Jul 2014 15:18:05 -0600

Thanks Kathleen, that makes sense. I do, however, think that a little
'should' would be more appropriate there than a big 'SHOULD' as there's no
other use of RFC2119 language in that text. That okay by you? It would read
like this:

A SAML Assertion may contain privacy-sensitive information and, to prevent
disclosure of such information to unintended parties, should only be
transmitted over encrypted channels, such as TLS. In cases where it’s
desirable to prevent disclosure of certain information the client, the
Subject and/or individual attributes of a SAML Assertion should be
encrypted to the authorization server.

On Sat, Jul 19, 2014 at 8:24 AM, Kathleen Moriarty <
[email-masked]> wrote:

> Thanks for the quick response, Brian.  I think the text looks great.  The
> only change I'd like to suggest is in the second sentence, to change the
> 'may' to 'SHOULD'.
>
> Best regards,
> Kathleen
>
> Sent from my iPhone
>
> Deployments should determine the minimum amount of information necessary
> to complete the exchange and include only that information in an Assertion
> Client Authentication and Authorization Grants [*http://tools.ietf.org/html/draft-ietf-oauth-assertions-16#section-6.3.1
>> http://datatracker.ietf.org/doc/draft-ietf-oauth-saml2-bearer.  The
>> draft looks great, thank you for all of your efforts on it!
>>

---

From: Kathleen Moriarty <[email-masked]>
Date: Sun, 20 Jul 2014 09:18:40 -0400

Thanks, Brian.  That looks good to me.

Kathleen

On Sat, Jul 19, 2014 at 5:18 PM, Brian Campbell <[email-masked]>
wrote:

>> How about the following (which is intentionally similar to the text I
>> just put forth for your request for privacy consideration in
>> A SAML Assertion may contain privacy-sensitive information and, to
>> prevent disclosure of such information to unintended parties, should only
>> be transmitted over encrypted channels, such as TLS. In cases where it’s

-- 

Best regards,
Kathleen

---

From: Brian Campbell <[email-masked]>
Date: Sun, 20 Jul 2014 07:47:58 -0700

Great, thanks Kathleen. I'll get new drafts published soon(ish).

On Sun, Jul 20, 2014 at 6:18 AM, Kathleen Moriarty <
[email-masked]> wrote:

> On Sat, Jul 19, 2014 at 5:18 PM, Brian Campbell <
> [email-masked]> wrote:
>
>>> Thanks for the quick response, Brian.  I think the text looks great.
>>>  The only change I'd like to suggest is in the second sentence, to change
>>> the 'may' to 'SHOULD'.
>>>
>>> Best regards,
>>> Kathleen
>>>
>>> Sent from my iPhone
>>>

---

From: Brian Campbell <[email-masked]>
Date: Wed, 23 Jul 2014 11:49:04 -0700

Thanks again for the review and feedback, Kathleen. I added privacy
considerations, as discussed on this thread, to the assertion drafts and
published them this morning.