Subject: RE: [dix] Re: attribute assertions

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 18 Jan 2006 13:57:12 -0800

> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of Suresh Venkatraman

> I'm not suggesting that DIX tackles the security problem; 
> what I am suggesting is that whatever mechanisms are chosen 
> for DIX cannot preclude the use of existing ready-to-run 
> security layers such as TLS, SASL mechanisms, or 
> digest-authentication. OTOH, if security is not given any 
> consideration then we might as well quit now.

It sounds reasonable, what I want to avoid is a situation like WiFi
where the access points support three different authentication
mechanisms equally poorly.

> > BEEP for example, zero traction in the commercial Web 
> Services world, 
> > negligible traction in the open source world, should be moved to 
> > historical. Same goes for XML-RPC.
> 
> I agree - anything that has zero traction today should not be 
> included. I'm am also of the same mind as far as building 
> something that can be implemented today and work across 
> multiple services, both entrenched (HTTP) and emerging (SIP). 

I would suggest that as far as the charter is concerned it should commit
to providing an HTTP binding and allow a SIP binding to be specified.

The reason for this is that SIP politics are not entirely concentrated
at the IETF. SIP hooks into the telephone network and there is a major
culture gap between Internet engineers and phone system engineers. It is
very difficult to get the two talking - even when they both work in the
same company.

It is probably easier to get the critical mass in the SIP area by
demonstrating the effectiveness of the system in the HTTP world first.

> Currently there's a big fight between SAML and WS-Federation, 
> I think we have to choose one to make this work (SAML), but 
> leave the exchange language extensible. 

They are both emerging protocols. I do not think that there is much
overlap in the area of attributes. There is an overlap in other parts of
the SAML spec.

Ultimately the problem of attributes comes down to defining a common
vocabulary of terms. SAML and WS-Federation both provide only mechanism.
Its like having RFC822 syntax without someone saying that there is a To
header and a From header etc.

_______________________________________________
dix mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dix

---

From: "Suresh Venkatraman" <[email-masked]>
Date: Wed, 18 Jan 2006 14:42:27 -0800

> header and a From header etc.

I'm in complete agreement. I don't want to end up with yet another identity
protocol with the over-the-wire portion left in limbo. The solution that
gets developed by the proposed DIX WG should be deployable when it is
ratified (or before).

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Hallam-Baker, Phillip
Sent: Wednesday, January 18, 2006 1:57 PM
To: Digital Identity Exchange
Subject: RE: [dix] Re: attribute assertions

---

From: John Merrells <[email-masked]>
Date: Wed, 18 Jan 2006 15:20:16 -0800

> gets developed by the proposed DIX WG should be deployable when it is

In the dmd1 terminology do you mean the parameters of the message or
the property names? dmd1 specifies the message parameters in detail.
Does this meet your deployability metric?

John