Re: [abfab] Direction Forward for aaa-saml

Alejandro Pérez Méndez <alex@um.es> Wed, 22 July 2015 16:12 UTC

Return-Path: <alex@um.es>
X-Original-To: abfab@ietfa.amsl.com
Delivered-To: abfab@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ECB651A882F for <abfab@ietfa.amsl.com>; Wed, 22 Jul 2015 09:12:26 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.911
X-Spam-Level:
X-Spam-Status: No, score=-3.911 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MSIX4qqz3CHV for <abfab@ietfa.amsl.com>; Wed, 22 Jul 2015 09:12:24 -0700 (PDT)
Received: from xenon23.um.es (xenon23.um.es [155.54.212.163]) by ietfa.amsl.com (Postfix) with ESMTP id 0C1801A6F2B for <abfab@ietf.org>; Wed, 22 Jul 2015 09:12:24 -0700 (PDT)
Received: from localhost (localhost [127.0.0.1]) by xenon23.um.es (Postfix) with ESMTP id 9AF8D2A6E for <abfab@ietf.org>; Wed, 22 Jul 2015 18:12:21 +0200 (CEST)
X-Virus-Scanned: by antispam in UMU at xenon23.um.es
Received: from xenon23.um.es ([127.0.0.1]) by localhost (xenon23.um.es [127.0.0.1]) (amavisd-new, port 10024) with LMTP id WRQafmSAvDUy for <abfab@ietf.org>; Wed, 22 Jul 2015 18:12:21 +0200 (CEST)
Received: from [192.168.20.74] (186.160.broadband14.iol.cz [90.181.160.186]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) (Authenticated sender: alex) by xenon23.um.es (Postfix) with ESMTPSA id 63444394 for <abfab@ietf.org>; Wed, 22 Jul 2015 18:12:20 +0200 (CEST)
To: abfab@ietf.org
References: <tslwpxsy0ql.fsf@mit.edu> <8E4E5965-0E43-4ABD-8853-8A6C7C6926C5@mnt.se> <tsloaj4xzvr.fsf@mit.edu> <0B96365A-4F6B-427A-9A87-70F069473F84@mnt.se> <tsl7fpsxrve.fsf@mit.edu> <0A08B89E-5533-4E34-9014-97C0D7877B6E@osu.edu> <tslio9cw8yd.fsf@mit.edu> <D143C9FB-F878-49C1-89C4-6A494714A3EC@mnt.se> <tslegk0w7iw.fsf@mit.edu> <1FA8CCED-221E-4A88-B525-BF46FAA53A3F@mnt.se>
From: =?UTF-8?Q?Alejandro_P=c3=a9rez_M=c3=a9ndez?= <alex@um.es>
Message-ID: <55AFC0E3.8030500@um.es>
Date: Wed, 22 Jul 2015 18:12:19 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.1.0
MIME-Version: 1.0
In-Reply-To: <1FA8CCED-221E-4A88-B525-BF46FAA53A3F@mnt.se>
Content-Type: text/plain; charset=windows-1252; format=flowed
Content-Transfer-Encoding: 8bit
Archived-At: <http://mailarchive.ietf.org/arch/msg/abfab/82g5qB2T01rFpIBKnWTRM8xrmtI>
Subject: Re: [abfab] Direction Forward for aaa-saml
X-BeenThere: abfab@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "Application Bridging, Federated Authentication Beyond \(the web\)" <abfab.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/abfab>, <mailto:abfab-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/abfab/>
List-Post: <mailto:abfab@ietf.org>
List-Help: <mailto:abfab-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/abfab>, <mailto:abfab-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 22 Jul 2015 16:12:27 -0000


El 22/07/15 a las 17:14, Leif Johansson escribió:
>
> 22 jul 2015 kl. 17:12 skrev Sam Hartman <hartmans@painless-security.com>om>:
>
>>>>>>> "Leif" == Leif Johansson <leifj@mnt.se> writes:
>>     Leif> 22 jul 2015 kl. 16:41 skrev Sam Hartman
>>     Leif> <hartmans@painless-security.com>om>:
>>
>>>>>>>>> "Cantor," == Cantor, Scott <cantor.2@osu.edu> writes:
>>>> Cantor,> On 7/22/15, 9:07 AM, "abfab on behalf of Sam Hartman"
>>>> Cantor,> <abfab-bounces@ietf.org on behalf of Cantor,>
>>>> hartmans@painless-security.com>
>>>> Cantor,> wrote:
>>>>
>>>>
>>>>>> I think you'd need to:
>>>>>>
>>>>>> 1) Explain how I figure out which entity I'm using for my
>>>>>> RADIUS server
>>>>>> Consider this especially in a case where you're retrieving
>>>>>> metadata dynamically rather than just having all the metadata
>>>>>> in the world.
>>>> Cantor,> That's orthogonal to any use of SAML metadata. How you
>>>> get Cantor,> it (and verify it) is architecturally distinct from
>>>> what it Cantor,> means and how it's used.
>>>>
>>>> Not really.  If I'm starting with an NAI realm and would like to
>>>> find the entity description of an entity that is at that NAI
>>>> realm, I can only do that if my metadata access mechanism lets me
>>>> search by that.
>>     Leif> so its a requirement for the mdquery draft, not on metadata
>>
>> Nod.
>>
>> I don't anticipate implementing using metadata  to select a RADIUS
>> endpoint.
>> So I don't have a lot of interest in working on that.  I'm happy to
>> review a specific proposal someone comes up with, but I'd prefer it not
>> end up in aaa-saml and I'd strongly prefer it not block aaa-saml.
>>
>> --Sam
> agree but i think endpoint could be useful for radsec and i suspect it will be reasonably simple to do

I might be mistaken, but wasn't that what we wanted to avoid in the 
first place when we decided not to use the RADIUS URI scheme from my 
original proposal?
I guess having an endpoint for radsec will require to define how the 
"Location" values will look like, and they should be in a URI format as 
well.

Regards,
Alejandro
> _______________________________________________
> abfab mailing list
> abfab@ietf.org
> https://www.ietf.org/mailman/listinfo/abfab