Subject: [dix] RE: attribute assertions

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Fri, 13 Jan 2006 18:54:38 -0800

> SAML is one way to make a digital assertion. Supporting SAML 
> would be A Good Thing.
> 
> There are also lighter weight ways of making verifiable 
> assertions that don't have the overhead, complexity and 
> potential uncertainty of SAML. 

I think that the complexity is in the problem rather than the solution.

> There are also IP issues there.

The only IP issue related to SAML I am aware of relates to four patents
held by RSA that are entirely independent of the SAML specification
itself. You do not escape the implications of the RSA patent by
implementing something other than SAML, all that gets you to is having
to cut a new license deal. 

> > For example I might have an account [email-masked], I 
> might log onto 
> > your blog and you might want to know what my Slashdot Karma is.
> >
> > I think that the missing piece here is the identifier. Once 
> you have a 
> > common agreement on an identifier the other pieces fall into place.
> 
> Agreed
> 
> 

_______________________________________________
dix mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dix

---

From: Dick Hardt <[email-masked]>
Date: Fri, 13 Jan 2006 19:07:00 -0800

> I think that the complexity is in the problem rather than the  

For problems as framed by SAML, likely. Is it not possible that not  
all problems that need a claim by a 3rd party have the same complexity?

> to cut a new license deal.

Yes, if you are infringing. No if you are not. I know that is stating  
the obvious. :-)

The last time I looked at the RSA license, you could not build a  
toolkit without them having to get a license from RSA. This makes it  
difficult to release open source modules. I see this is a huge  
barrier to adoption in the more innovative, less commercial markets.

But the format of the assertion we are thinking out of scope for DIX.  
The focus is how to move the identity data around.

-- Dick