Re: [abfab] Naming of SAML and AAA systems

Hi Josh

I guess you have two options
i) some sort of directory or metadata or config file in which names are 
listed and there is no requirement for them to be algorithmically 
related to each other, or
ii) having a mandatory naming convention that specifies how related 
entities are named, and from which you can determine the relationships.

Going with ii) suffers from problems if the relationships that are 
implicitly assumed in the naming convention turn out to be different in 
practice e.g. you assume 1 to 1 relationships between entities but they 
turn out to be 1 to n or n to n. Also what happens if new (sub)types of 
entities arise? You might end up having to change the code base to 
support them.

I think i) is safer, but it has additional costs of requiring support 
for the directory/discovery mechanism

regards

David

On 11/06/2013 14:52, Josh Howlett wrote:
> I'm currently updating abfab-aaa-saml. The document is a bit unambiguous
> about the naming of system entities, specifically:
>
>   1. There is no attempt to correlate the AAA and SAML entity naming (the
> transport and message levels respectively). I believe that we need a
> naming convention such that it is trivial to reliably infer a system
> entity's AAA or SAML name, given the other name.
>
>   2. We don't yet have a mechanism for naming the functional roles of SAML
> entities within a realm, which I believe is needed to satisfy the
> attribute request and aggregation use cases. For example, an acceptor
> wanting additional attributes for an authenticated user from realm Foo
> from another attribute authority in realm Bar.
>
> Here's my proposal:
>
>   * A SAML system names itself using an entity identifier is a URI that
> encodes the AAA system's FQDN. For example "abfab:idp.example.com" and
> "abfab:rp.example.com" would name two hosts with FQDNs of idp.example.com
> and rp.example.com. For an RP, this entity identifier value (less the
> abfab prefix) will therefore be equal to the value of the
> GSS-Acceptor-Host-Name RADIUS attribute. It is worth noting that section
> 4.3 of RFC3588 specifies a URI scheme for AAA protocols, but it looks a
> bit elaborate for what we need (and possibly not complete, given the
> RADIUS transport options today). Irrespective of the convention we choose,
> RADIUS entities emitting SAML messages MUST use it.
>
>   * SAML system entities are able to locate SAML entities within other
> realms using RADIUS by using well-known values for the user fragment of
> the NAI. For example, a relying party would resolve an attribute authority
> in realm by using an NAI with value "abfab:aa@example.com". This might
> return a SAML assertion issued by an entity named "abfab:idp.example.com".
> Similarly an authorisation PDP might be resolved using
> "abfab:pdp@example.com".
>
> Opinions?
>
> Josh.
>
>
>
> Janet(UK) is a trading name of Jisc Collections and Janet Limited, a
> not-for-profit company which is registered in England under No. 2881024
> and whose Registered Office is at Lumen House, Library Avenue,
> Harwell Oxford, Didcot, Oxfordshire. OX11 0SG. VAT No. 614944238
>
> _______________________________________________
> abfab mailing list
> abfab@ietf.org
> https://www.ietf.org/mailman/listinfo/abfab
>