Re: [abfab] Direction Forward for aaa-saml

[Leif Johansson <[e-mail]>]

On 2015-07-22 18:12, Alejandro Pérez Méndez wrote:
> 
> 
> El 22/07/15 a las 17:14, Leif Johansson escribió:
>>
>> 22 jul 2015 kl. 17:12 skrev Sam Hartman <[e-mail]>:
>>
>>>>>>>> "Leif" == Leif Johansson <[e-mail]> writes:
>>>     Leif> 22 jul 2015 kl. 16:41 skrev Sam Hartman
>>>     Leif> <[e-mail]>:
>>>
>>>>>>>>>> "Cantor," == Cantor, Scott <[e-mail]> writes:
>>>>> Cantor,> On 7/22/15, 9:07 AM, "abfab on behalf of Sam Hartman"
>>>>> Cantor,> <[e-mail] on behalf of Cantor,>
>>>>> [e-mail]>
>>>>> Cantor,> wrote:
>>>>>
>>>>>
>>>>>>> I think you'd need to:
>>>>>>>
>>>>>>> 1) Explain how I figure out which entity I'm using for my
>>>>>>> RADIUS server
>>>>>>> Consider this especially in a case where you're retrieving
>>>>>>> metadata dynamically rather than just having all the metadata
>>>>>>> in the world.
>>>>> Cantor,> That's orthogonal to any use of SAML metadata. How you
>>>>> get Cantor,> it (and verify it) is architecturally distinct from
>>>>> what it Cantor,> means and how it's used.
>>>>>
>>>>> Not really.  If I'm starting with an NAI realm and would like to
>>>>> find the entity description of an entity that is at that NAI
>>>>> realm, I can only do that if my metadata access mechanism lets me
>>>>> search by that.
>>>     Leif> so its a requirement for the mdquery draft, not on metadata
>>>
>>> Nod.
>>>
>>> I don't anticipate implementing using metadata  to select a RADIUS
>>> endpoint.
>>> So I don't have a lot of interest in working on that.  I'm happy to
>>> review a specific proposal someone comes up with, but I'd prefer it not
>>> end up in aaa-saml and I'd strongly prefer it not block aaa-saml.
>>>
>>> --Sam
>> agree but i think endpoint could be useful for radsec and i suspect it
>> will be reasonably simple to do
> 
> I might be mistaken, but wasn't that what we wanted to avoid in the
> first place when we decided not to use the RADIUS URI scheme from my
> original proposal?
> I guess having an endpoint for radsec will require to define how the
> "Location" values will look like, and they should be in a URI format as
> well.
> 

We agree that we want something other than Entpoint for name2key binding
but we are still debating if we want Endpoint for the radsec
case. It is debatable.