Subject: [kitten] Status of SAML-EC draft and open issues

From: "Cantor, Scott" <[email-masked]>
Date: Mon, 26 Mar 2012 15:39:39 +0000

I hope to be in the chatroom tomorrow morning (my time), but regardless,
here's a current summary:

NCSA has implementation work proceeding as part of a funded project to
prototype the draft mechanism initially with SSH as the test protocol. The
initial feedback from that work was incorporated into a new draft last
month, mostly to relax some assumptions about TLS being the only secure
transport layer involved, which is not true with SSH of course.

An additional item identified by the work was the absence of proper
guidance on mechanism name handling, which I had identified a while ago as
something that needed attention. The acceptor side will be based on
GSS_C_NT_HOSTBASED_SERVICE, but there needs to be language added on
mapping that to and from SAML entityID format.

The initiator name needs to be expressed in terms of the SAML NameID
element, or in its absence, some convention for representing an anonymous
initiator (which could be carrying GSS naming attributes to actually
identify the subject of course). So I need to define a mechanism name type
and import/export guidance.

I'm curious how that can be left out of the non-EC SAML mechanism, which
has the same problem, seems to me. (Same goes for OAuth and OpenID, IMHO,
though not in terms of SAML obviously.)

Anyway, I'm going to be doing some work to draft something on that
shortly. If I'm right that this problem applies to the non-EC mechanism,
I'm of course willing to discuss something in common with those authors.

The other major open item involves per-message token support. I exchanged
some mail a while ago on that with Sam and I have at least a general idea
on what to try adding, but the name issue above is higher priority at the
moment.

Finally, I'm tracking
http://tools.ietf.org/html/draft-ietf-abfab-gss-eap-naming-02 and I would
guess that I'll want to reference that from the EC draft as a convention
for putting the SAML information into naming attributes.

Those are the issues I'm aware of at this point. The two OASIS
dependencies are so far holding stable, but I'm not advancing them there
until I know for sure they don't need changes.

-- Scott