Subject: [dix] RE: attribute assertions

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Fri, 13 Jan 2006 19:50:15 -0800

> From: Dick Hardt [mailto:[email-masked]] 

> > I think that the complexity is in the problem rather than the 
> > solution.
> 
> For problems as framed by SAML, likely. Is it not possible 
> that not all problems that need a claim by a 3rd party have 
> the same complexity?

I don't think it is possibel to answer your objection here without an
indication of where you see the complexity in SAML.

The basic assertion framework is pretty compact, the schema is only a
couple of pages long. The conditions and advice components are entirely
optional. 

> Yes, if you are infringing. No if you are not. I know that is 
> stating  the obvious. :-)

I was never convinced that we were infringing. However RSA was asked if
they had any IPR that MIGHT infringe on the standard and they replied
yes, then followed up with a royalty free license under standard
reciprocal terms in full compliance with both the W3C and OASIS IPR
policies.

Given the subject matter of DIX I do not think it very likely that the
RSA engineers are not going to attend the Working Group if formed. The
IETF 'note well' rules then require them to make the same disclosure
they made in SAML.

> The last time I looked at the RSA license, you could not build a  
> toolkit without them having to get a license from RSA. This makes it  
> difficult to release open source modules. I see this is a huge  
> barrier to adoption in the more innovative, less commercial markets.

I do not see the difference in the situation here. The RSA patents have
broad claims. If there is an arguable case that they cover SAML there is
an arguable case that they cover DIX as well. Patent law does not
require a patent holder to assert their claims in order to preserve
them.

At the end of the day it costs over $2 million to mount or defend a
patent lawsuit in the USA. It is highly unlikely that anyone is going to
mount a case over a defect in a royalty free license unless provoked by
another patent suit.

Given where the interminable wrangling over IPR got us in MARID I
strongly suggest that the DIX WG adopt the W3C IPR licensing terms as a
requirement. These have already been agreed to by Apache and the major
Open Source groups and by all the major vendors who hold IPR and are
likely to issue royalty free licenses.

> But the format of the assertion we are thinking out of scope 
> for DIX. The focus is how to move the identity data around.

I think I need to see some bits on the wire before I can understand the
distinction you are attempting to draw here. 

As I see it there are two parts to an identity protocol:

* There is an authentication process which allows the identity holder to
claim their identity by authenticating themselves against an uniformly
resolved identifier.

* There is an attribute retrieval protocol that allows the relying party
to obtain assertions binding particular attributes to the authenticated
identifier. The source of these assertions may or may not be the same as
the source of the authentication decision. The atteribute assertions may
or may not be trustworthy and may or may not be trusted.

If the first part AND the second part are both out of scope, what is
left?

_______________________________________________
dix mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dix

---

From: Dick Hardt <[email-masked]>
Date: Mon, 16 Jan 2006 18:28:15 -0800

> couple of pages long. The conditions and advice components are  

First of all, I'd like to clarify that I think SAML is a great  
solution for a number of existing problems.

If a site wants my email address, my blog URL, a link to my buddy  
icon etc. SAML is more horse power than I need to automate the  
exchange of that identity data. The use of SAML requires an XML  
parser. Name / value pairs are all that are required to move this  
simple data.

If a site just wants to know I am the same entity that has visited in  
the past, then SAML is "heavy" as well.

> IETF 'note well' rules then require them to make the same disclosure

I hope the RSA people do join. Lots of smart people there.

> require a patent holder to assert their claims in order to preserve

Which makes you wonder why RSA makes you sign the license. The issue  
is the barrier created by having to execute their license.

> likely to issue royalty free licenses.

I like the Apache IPR terms myself.

> distinction you are attempting to draw here.

hopefully that will add clarity!

> If the first part AND the second part are both out of scope, what is

I think there is more to identity exchange then those two points. I  
break it down as such:

1) Discovery: negotiation between the parties on how to communicate  
and capabilities

2) Authentication: the user proving who they as you discuss above

3) Attribute exchange: retrieving one or more attributes. In essence  
a query. I think there should also be a way to store attributes.

4) Attribute schema: the method of describing the attribute(s) to be  
exchanged

5) Verification: the process of checking if one or more attributes  
are "trustworthy"

I think there is lots of stuff that solves (2). I think there are  
some standards for the others, but it is not all well glued together  
as you mention.