Subject: RE: Follow up on Authorize Only issue (was RE: [Isms] ISMS session

From: "Avi Lior" <[email-masked]>
Date: Wed, 26 Jul 2006 13:41:49 -0400

Hi Hannes,

When I wrote the word "assertion"  I was thinking a SAML assertion.

A word of caution though, everytime I mention XML to my AAA developers
they conspire to kill me.

XML, parsing strings etc are performance killers for a AAA server.

> -----Original Message-----
> From: Hannes Tschofenig [mailto:[email-masked]] 
> Sent: Wednesday, July 26, 2006 4:55 AM
> To: Avi Lior
> Cc: Glen Zorn (gwz); David Harrington; Eliot Lear; 
> [email-masked]; [email-masked]
> Subject: Re: Follow up on Authorize Only issue (was RE: 
> [Isms] ISMS session
> 
> Hi Avi,
> 
> I like the idea of using some information to tie the 
> authentication and the authorization process/exchange 
> together. In fact we discussed this at the last IETF meeting 
> when David gave his presentation.
> 
> I suggested to use an existing mechanism to accomplish this 
> binding, namely SAML. I can elaborate a bit more about the 
> details if someone case about it.
> 
> Ciao
> Hannes
> 
> Avi Lior wrote:
> > I proably did not make myself clear....or maybe I did and I 
> am missing 
> > something.
> > 
> > When the NAS sends the Access-Request Auth-Only message I 
> agree that 
> > it MUST contain Message-Authenticator(80) etc...
> > 
> > What I meant is that it would be nice if there was a token or an 
> > assertion that came from the place that did authenticate 
> the user  to 
> > indicate in a cryptographic way that this user was authenticated.
> > 
> > The AAA server can use that token to verify that the user was 
> > authenticated by an entity that it trusts.  Like a kerberose ticket.
> > 
> > 
> > 
> > 
> >>-----Original Message-----
> >>From: Glen Zorn (gwz) [mailto:[email-masked]]
> >>Sent: Tuesday, July 25, 2006 3:47 PM
> >>To: Avi Lior; David Harrington; Eliot Lear
> >>Cc: [email-masked]; [email-masked]
> >>Subject: RE: Follow up on Authorize Only issue (was RE: 
> >>[Isms] ISMS session
> >>
> >>Avi Lior <mailto:[email-masked]> supposedly scribbled:
> >>
> >>
> >>>Hi,
> >>>
> >>>If I was specifying how this is done:
> >>>
> >>>It would be nice if the AAA client could return some sort
> >>
> >>of token to
> >>
> >>>the AAA server to assert that the user has been 
> authenticated by an 
> >>>entity that it trusts. The token can be generated by the
> >>>Authentication Server.   
> >>>
> >>>We need this assertion to make sure we deliver the correct profile.
> >>
> >>I disagree: the fact that the message is being sent by an 
> >>authenticated client at all says that the user has been 
> authenticated 
> >>elsewhere.  Note that safety requires the inclusion of a 
> MAC (either 
> >>the Message-Authenticator or preferably the 
> >>Message-Authentication-Code Attribute) in the Access-Request.
> >>
> >>Hope this helps,
> >>
> >>~gwz
> >>
> >>Why is it that most of the world's problems can't be solved 
> by simply
> >>  listening to John Coltrane? -- Henry Gabriel
> >>
> > 
> > 
> > --
> > to unsubscribe send a message to 
> [email-masked] with 
> > the word 'unsubscribe' in a single line as the message text body.
> > archive: <http://psg.com/lists/radiusext/>
> > 
> > 
> 
> 

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: "Glen Zorn \(gwz\)" <[email-masked]>
Date: Wed, 26 Jul 2006 11:18:21 -0700

> When I wrote the word "assertion"  I was thinking a SAML assertion.

In order for this to have any meaning at all, the source of this assertion would need to be  trusted by both the RADIUS client and server.  This seems to imply a bunch of new keys, at a minimum, unless you don't care to authenticate the token/assertion/whatever (in which case why bother?).  In addition, the token/assertion/whatever would need to be somehow delivered from something, somewhere in a secure fashion to the RADIUS client for forwarding to the RADIUS server.  Aside from those minor nits (modifying both the RADIUS entities to receive, transmit & understand the token/assertion/whatever & more than likely the SSH/Kerberos/whatever entities to actually generate & deliver the token/assertion/whatever), I think this is a great idea.

> 
> A word of caution though, everytime I mention XML to my AAA
> developers they conspire to kill me. 

Good people & wise!

>> Cc: Glen Zorn (gwz); David Harrington; Eliot Lear; [email-masked];
>> [email-masked] Subject: Re: Follow up on Authorize Only
>> issue (was RE: [Isms] ISMS session 
>> 
>> Hi Avi,
>> 
>> I like the idea of using some information to tie the authentication
>> and the authorization process/exchange together. In fact we discussed
>> this at the last IETF meeting when David gave his presentation.
>> 
>> I suggested to use an existing mechanism to accomplish this binding,
>> namely SAML. I can elaborate a bit more about the details if someone
>> case about it. 
>> 
>> Ciao
>> Hannes
>> 
>> Avi Lior wrote:
>>> I proably did not make myself clear....or maybe I did and I am
>>> missing something. 
>>> 
>>> When the NAS sends the Access-Request Auth-Only message I agree that
>>> assertion that came from the place that did authenticate the user 
>>> to indicate in a cryptographic way that this user was authenticated.
>>> 
>>>> Subject: RE: Follow up on Authorize Only issue (was RE: [Isms]
>>>> ISMS session 
>>>> 
>>>>> the AAA server to assert that the user has been authenticated by
>>>>> an entity that it trusts. The token can be generated by the
>>>>> Authentication Server. 
>>>>> 
>>>> authenticated elsewhere.  Note that safety requires the inclusion
>>>> of a MAC (either the Message-Authenticator or preferably the
>>>> Why is it that most of the world's problems can't be solved by
>>>>  simply listening to John Coltrane? -- Henry Gabriel
>>>> 
>>> 
>>> 
>>> --

Hope this helps,

~gwz

Why is it that most of the world's problems can't be solved by simply
  listening to John Coltrane? -- Henry Gabriel

---

From: "Avi Lior" <[email-masked]>
Date: Thu, 27 Jul 2006 12:08:16 -0400

I know, but AAA and Liberty Alliance perform different functions and
probably have different performance requirements.

But you are probably right.  My developers will have to cave one day.

The question is, will they kill me first or will I manage to survive. 

> Sent: Thursday, July 27, 2006 4:08 AM
> To: Avi Lior
> your developers might need to get used to XML sooner or later 
> anyway based on the excitement for Liberty Alliance nowadays. 
> The functionality of the asserting party in SAML is very 
> close to what a AA(A) does today.
> 
> Ciao
> Hannes
> 
> Avi Lior wrote:
> > Hi Hannes,
> > 
> >>[email-masked]
> binding,