Subject: Re: [scim] Secdir review of draft-ietf-scim-use-cases

From: "Kepeng Li" <[email-masked]>
Date: Wed, 08 Apr 2015 09:01:32 +0800

Hi Magnus,

Thanks for the review.

>Section 3.5: Shouldn't there also be a requirement for the secure transfer of
attributes between A and B based on matters such as A trusting authentication
results from B, a means to provide those authentication results securely to B,
etc.? Essentially similar to what was presented in Section 3.3?

OK, I propose to add the following to section 3.5 as requirements:

      Relying party B must be able to authenticate the end user
      Relying party B must be able to securely provide the authentication
results to directory service A
      Directory service A must be able to securely provide end user’s
identity information (e.g., attributes) to relying party B

>Section 3.6: Similar comment as for Section 3.5. There seems to be general
security requirements missing for these two scenarios?

Similarly, I propose to add the following sentences to section 3.6 as
requirements:

      Relying party B must be able to authenticate the end user
      Relying party B must be able to securely provide the authentication
results to directory service A
      Directory service A must be able to securely provide end user’s
changed identity information (e.g., attributes) to relying party B

>Section 4:  Editorial suggestion: "only authenticated entity" -> "only
authenticated entities”.

OK.

Please let me know if the proposed changes above are fine with you.

Thanks,

Kind Regards
Kepeng

发件人:  Magnus Nyström <[email-masked]>
日期:  Monday, 6 April, 2015 9:51 am
至:  "[email-masked]" <[email-masked]>,
<[email-masked]>
主题:  Secdir review of draft-ietf-scim-use-cases
重发发件人:  <[email-masked]>
重发收件人:  <[email-masked]>
重发日期:  Sun,  5 Apr 2015 18:51:14 -0700 (PDT)

I have reviewed this document as part of the security directorate's ongoing
effort to review all IETF documents being processed by the IESG. These
comments were written primarily for the benefit of the security area
directors. Document editors and WG chairs should treat these comments just
like any other last call comments.

This memo describes the "System for Cross-domain Identity Management
(SCIM)." SCIM is a companion document to the SCIM Schema memo and the SCIM
Protocol memo.

Section 3.5: Shouldn't there also be a requirement for the secure transfer
of attributes between A and B based on matters such as A trusting
authentication results from B, a means to provide those authentication
results securely to B, etc.? Essentially similar to what was presented in
Section 3.3?

Section 3.6: Similar comment as for Section 3.5. There seems to be general
security requirements missing for these two scenarios?

Section 4: I only glanced the Security Consideration sections referenced
here, but they do seem adequate, and given that I don't see that this memo's
Security Consideration section need to contain more information. Editorial
suggestion: "only authenticated entity" -> "only authenticated entities".

-- Magnus

---

From: Magnus Nyström <[email-masked]>
Date: Mon, 13 Apr 2015 19:26:42 -0700

Thanks, these updates look good to me. Best,

On Tue, Apr 7, 2015 at 6:01 PM, Kepeng Li <[email-masked]>
wrote:

> Hi Magnus,
>
> Thanks for the review.
>
> >Section 3.5: Shouldn't there also be a requirement for the secure
> transfer of attributes between A and B based on matters such as A trusting
> >Section 3.6: Similar comment as for Section 3.5. There seems to be
> general security requirements missing for these two scenarios?
>
> 至: "[email-masked]" <[email-masked]>, <
> [email-masked]>
> I have reviewed this document as part of the security directorate's
> ongoing effort to review all IETF documents being processed by the IESG.
> These comments were written primarily for the benefit of the security area
> here, but they do seem adequate, and given that I don't see that this
> memo's Security Consideration section need to contain more information.
> Editorial suggestion: "only authenticated entity" -> "only authenticated
> entities".
>
> -- Magnus
>

-- 
-- Magnus

---

From: "Kepeng Li" <[email-masked]>
Date: Wed, 15 Apr 2015 09:49:01 +0800

Thank you Magnus.

Here is the updated draft to reflect the changes:
https://datatracker.ietf.org/doc/draft-ietf-scim-use-cases/

Diff from previous version:
http://www.ietf.org/rfcdiff?url2=draft-ietf-scim-use-cases-06

Kind Regards
Kepeng

发件人:  Magnus Nyström <[email-masked]>
日期:  Tuesday, 14 April, 2015 10:26 am
至:  Li Kepeng <[email-masked]>
抄送:  scim <[email-masked]>, <[email-masked]>
主题:  Re: [scim] Secdir review of draft-ietf-scim-use-cases

On Tue, Apr 7, 2015 at 6:01 PM, Kepeng Li <[email-masked]>
wrote:
>       Directory service A must be able to securely provide end user’s identity
> information (e.g., attributes) to relying party B
> 
>       Directory service A must be able to securely provide end user’s changed
> This memo describes the "System for Cross-domain Identity Management (SCIM)."
> SCIM is a companion document to the SCIM Schema memo and the SCIM Protocol
> memo.
> 
> Section 4: I only glanced the Security Consideration sections referenced here,
> but they do seem adequate, and given that I don't see that this memo's

-- 
-- Magnus
_______________________________________________ scim mailing list
[email-masked] https://www.ietf.org/mailman/listinfo/scim