Subject: Re: The Lightness of SAMLv2, or not (Re: [dix] draft proposed charter - consensus?)

From: Dick Hardt <[email-masked]>
Date: Tue, 14 Feb 2006 02:17:22 -0800

Sorry for the late response Nick, I had a flood of email a while ago  
and am now just catching up ...

On 25-Jan-06, at 11:03 AM, Nick Ragouzis wrote:

> Dick Hardt <[email-masked]> @ Wed, 25 Jan 2006 00:13:31 -0800 wrote:
>
>> On 24-Jan-06, at 9:23 AM, Tom Doman wrote:
>>
>>> Yes, Leslie, taking your thought further, it makes me wonder, how
>>> does the DIX protocol end up being much different from SAML?  Dick,
> ...
>>> but I'd like to have you weigh in
> ...
>>> where
> ...
>>> SAML is lacking or perhaps inappropriate for digital identity
>>> information exchange?
>>>
>
> NR: I think this is an important question to answer with specifics,
>     as best as one can in the moment, before we dedicate a lot of
>     energy and resources -- if we're going for an improvement in
>     some dimension(s), then it serves us to be clear about it.

Agreed.

>
>>
>> Hey Tom
>>
>> I think the SAML authors did a great job of standardizing a language
>> to represent assertions to be moved between systems, and was driven
>> by vendors wanting to enable interop with between their enterprise
>> solutions.
>
> NR: Um, was driven ^in part^ by such vendors. In this forum, in the
>     inclusive fashion marking this and other SDO, let's be straight
>     about this, or be silent. Self-interest has many guises.

Not sure what your point is here, sorry.

>
> [
>> I think it is/was difficult from that point of reference
>> to think of how to move digital identity around at Internet
>> scale, or to scale down the required technological footprint for
> ]
> ...
>> low risk, low value identity transactions.
>
> NR: Seems a reasonable use case. But not one exclusive of SAML, right?
>     Possibly also the case, in the least, that relying parties might
>     be served by being able to easily distinguish among, and even have
>     granular mechanisms for selecting the 'level' of, the footprint
>     (and security). Which suggests certain mechanisms as valued in
>     each of the protocols -- but which might not be strictly
>     necessary in any of them alone.

SAML immediately implies an XML document. That is heavier then name/ 
value pairs.

>
>> Processing digitally signed XML is much harder then fetching
>> an HTML page and working with name/pairs.
>
> NR: This is a non-sequitor to your claim, below. If it's possible in
>     some future for DIX to handle the 'SAML token', well then you're
>     suggesting inclusion of precisely this sort of thing within DIX
>     (the processing digital sigs).

SAML tokens could be moved around by DIX. That does not mean all data  
has to be in SAML tokens. Lots of low value transactions can be done  
with name/value pairs, and no need for XML or XML-DSIG.

>
>     And, OTOH, within the SAML (i.e., v2.0) WebSSO, the "fetching"
>     (assuming from this para and by the below you mean the transport
>     part) can be precisely just dealing in straightforward REST.
>
> [
>> SAML is pretty heavy to move my name, email address and blog URL.
>> It also does not integrate well into existing applications. The ID
>> submitted allows an existing form to use DIX with the addition of  
>> HTML,
> ]
> ...
>> and no change to the existing form processing code (assuming the
>> required fields are available)
>
> NR: Well, not quite. The minimal change is the required change:
>     to make the application aware of identity attestations of a
>     trusted third party.

only if you need that in your application. Lots of existing  
applications just need name/value pairs. DIX could be added to such a  
site without any code change, just additional HTML

>
>     So far I'm not convinced by your characterization, Dick.
>
>     Let's take a "what if".
>
>     Let's create a SAMLv2.0 "SAML-LowLow" profile, a sort of reduction
>     to SAMLv2.0 WebSSO HTTPPost, that removes any signature  
> requirement
>     (even tho that's token, not necssrly transport), and assumes some
>     of the party/counterparty status that's assumed in the ID (leaving
>     any transport-related digest or dsig to the same discussion needed
>     in dix).
>
>     Here's a rough of the "heaviness" of such a speculative profile  
> (of
>     which obvious parts can appear in htmlforms, and for which I've
>     ignored the trivial serialization into url form):
>
> Request (by relying party):
>  @ID of the request
>  @Version of the protocol
>  @IssueInstant of the request
>  Issuer UID
>  Subject identifier related to the request
>
> Response (by authority):
>  @ID of the resp
>  @Version of the protocol
>  @IssueInstant
>  @InResponseTo the RequestID
>  Status for request
>  Assertion (unsigned in this SAML-LowLow profile):
>    @ID of the assertion
>    @Version of the protocol
>    @IssueInstant
>    Issuer UID
>    Subject's ID
>    Authentication Statement
>      @AuthnInstant
>      AuthnContext
>
>
> NR: Right off this is indeed heavier. But what's the *objective* bar?

Really simple to implement. :)

>
>     Some of the extras are probably unnecessary for the "low risk, low
>     value" use case, sure. Unfortunately, or not, using SAMLv2 you
>     can't really shed yourself of those attributes on the base
>     request and response elements. But these particular 'extras' are
>     trivial capabilities inherent in any forms generation and
>     processing engine, right?

Are they though? Why don't form generators have them then?

>
>     Beyond that this "SAML-LowLow" profile could even be lighter,
>     if that’s what's required. Such as removing the Authentication
>     statement ... although I'm at a loss for why that would save
>     significant resources when doing so would remove some valuable
>     *optional* capabilities for the requester.
>
>     Of course a further simplified version of this could be had by
>     profiling the Liberty ID-FF1.2 standard.
>
>     And, more, this doesn't handle capability discovery. But that's
>     not DIX's raison d'etre as of yet, right?

Well, that is part of the problem with SAML. It is not clear to an  
average web developer how to get it all up and running.

Perhaps another way of looking at this is to ask the following  
questions:

Why is SAML not widely adopted? Why is it not being used at Amazon,  
Yahoo!, Google or MSN?  It has been around long enough.
Why was SMTP standardized when X.400 was being worked on?
Why was LDAP created when X.500 was looming?

My opinion is because X.400 and X.500 were too heavy and did not  
easily solve the problems people wanted to solve.

SAML solves some people's problems, but clearly is not solving a  
bunch of other people's problems, or it would have been adopted by now.

-- Dick

_______________________________________________
dix mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dix

---

From: Pete Rowley <[email-masked]>
Date: Tue, 14 Feb 2006 11:51:56 -0800

> bunch of other people's problems, or it would have been adopted by now.

This, for me, sums up what DIX should be about.  There has been a 
suggestion that DIX is biting off more than it can chew - but it seems 
to me it is rather avoiding a whole host of complexity in order to solve 
a simple problem simply.  It is trivially easy implement the DMD0 
protocol for example, and that is usually a good indicator of likely 
adoption (assuming the problem is actually solved in a reasonable manner).

One key thing is that DMD0 is really just grease to make existing wheels 
go round, it does not force adoption of major infrastructure, deployment 
of new servers, or that users or sites change the way they do things.  
Real world people just want their real world problems solved, and I 
would like the focus of DIX to remain on that, rather than attempting to 
be yet another total identity solution.

-- 
Pete

---

From: "Duane Nickull" <[email-masked]>
Date: Tue, 14 Feb 2006 14:44:20 -0800

Adobe is using SAML.  Anyone at RSA can drop by our booth to see.

Duane

*******************************
Adobe Systems, Inc. - http://www.adobe.com
Vice Chair - UN/CEFACT  http://www.uncefact.org/
Chair - OASIS SOA Reference Model Technical Committee
Personal Blog - http://technoracle.blogspot.com/
******************************* 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Pete
Rowley
Sent: Tuesday, February 14, 2006 11:52 AM
To: Digital Identity Exchange
Subject: Re: The Lightness of SAMLv2, or not (Re: [dix] draft proposed
charter- consensus?)

-- 
Pete

---

From: Anthony Nadalin <[email-masked]>
Date: Tue, 14 Feb 2006 17:11:37 -0600

Why does one care about the "lightness", seems that the consumability is
the factor, as every device we use gets heavier and heavier, we learned
this with the 4MB OS battle we had, things grow.

Anthony Nadalin | Work 512.838.0085 | Cell 512.289.4122

             "Duane Nickull"                                               
             <[email-masked]                                             
             om>                                                        To 
             Sent by:                  <[email-masked]>                      
             dix-bounces@ietf.                                          cc 
             org                                                           
                                                                   Subject 
                                       RE: The Lightness of SAMLv2,  or    
             02/14/2006 04:44          not (Re: [dix] draft proposed       
             PM                        charter- consensus?)                

             Please respond to                                             
             Digital Identity                                              
                 Exchange                                                  
              <[email-masked]>                                               

Duane

-----Original Message-----

--
Pete

(See attached file: smime.p7s)
_______________________________________________
dix mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dix
_______________________________________________
dix mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dix

---

From: Pete Rowley <[email-masked]>
Date: Tue, 14 Feb 2006 15:18:49 -0800

>Adobe is using SAML.  Anyone at RSA can drop by our booth to see.
How many external sites are you able to interoperate with?

-- 
Pete

---

From: Ben Laurie <[email-masked]>
Date: Wed, 15 Feb 2006 11:08:51 +0000

> this with the 4MB OS battle we had, things grow.

Because the heavier a system is the more code has to be written. Code
costs money, even free code.

-- 
http://www.apache-ssl.org/ben.html       http://www.thebunker.net/

"There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit." - Robert Woodruff

---

From: Cat Okita <[email-masked]>
Date: Wed, 15 Feb 2006 12:15:36 -0500 (EST)

> costs money, even free code.

... and oddly enough, the more code that's written, the more scope there
is for errors.

cheers!
==========================================================================
"A cat spends her life conflicted between a deep, passionate and profound
desire for fish and an equally deep, passionate and profound desire to
avoid getting wet.  This is the defining metaphor of my life right now."

---

From: David Boreham <[email-masked]>
Date: Wed, 15 Feb 2006 11:00:13 -0700

I'm not sure that we need to speculate on the reasons why
'heavy' standards are not widely used. It's an observed fact.
The only reason I'd want to think about why this is would be
if I were planning to make a heavy standard that did not have
whatever the badness is that cases lack of adoption. Personally
I would not bother with that line of thinking: instead I'd go make
a 'light' standard...

And that I believe is roughly the goal of this present effort.

---

From: Anthony Nadalin <[email-masked]>
Date: Wed, 15 Feb 2006 13:32:45 -0600

>speculate on the reasons why 'heavy' standards are not widely used. It's
an observed fact.
First I don't believe that as we have successfully deployed many "heavy"
standards along with other companies.

Also there are many factors that can play in "heavy" standards, the amount
of code is one of them
but not the most important factor. We see "heavy" as being very complex,
and not consumable, and these 2 characteristic could fall into other's
"Lightness".u

                                                                           
             David Boreham                                                 
             <david_list@boreh                                             
             am.org>                                                    To 
             Sent by:                  Digital Identity Exchange           
             dix-bounces@ietf.         <[email-masked]>                      
             org                                                        cc 
                                                                           
                                                                   Subject 
             02/15/2006 12:00          Re: The Lightness of SAMLv2, or not 
             PM                        (Re: [dix] draft proposed charter-  
                                       consensus?)                         
                                                                           
             Please respond to                                             
             david_list@boreha                                             
               m.org; Please                                               
                respond to                                                 
             Digital Identity                                              
                 Exchange                                                  
              <[email-masked]>

---

From: Pete Rowley <[email-masked]>
Date: Wed, 15 Feb 2006 13:41:30 -0800

Anthony Nadalin wrote:

> >speculate on the reasons why 'heavy' standards are not widely used. 
> It's an observed fact.
> First I don't believe that as we have successfully deployed many 
> "heavy" standards along with other companies.
>
Success of one or more companies deploying anything is not an indicator 
of wide adoption.    This is particularly true for larger companies, 
which tend to deploy pretty much everything somewhere, though not 
necessarily widely even within that company.  By any measure, the 
current crop of extranet "identity" protocols cannot be said to be 
deployed widely.  My gut tells me that even those that are deployed at 
all don't see much in the way of extranet action. Which, after all, was 
the only "problem" that didn't already have abundant and adequate 
solutions, nobody needed those protocols for logging into the intranet 
portal.

I think the underlying issue here is who doesn't have what they need, 
why is it they don't have it, and do we care to solve that problem?  The 
contention is that individual web users and web sites do not have what 
they need because what is available standards-wise is too complex to  be 
developed widely or to deploy widely, particularly in the smaller scale 
operation.  Clearly some want to solve that problem.

> Also there are many factors that can play in "heavy" standards, the 
> amount of code is one of them
> but not the most important factor. We see "heavy" as being very 
> complex, and not consumable, and these 2 characteristic could fall 
> into other's "Lightness".u
>
I prefer the term "simple", then everyone can agree what it means.

-- 
Pete