Re: [abfab] Naming of SAML and AAA systems

> -----Original Message-----
> From: abfab-bounces@ietf.org [mailto:abfab-bounces@ietf.org] On Behalf
> Of Josh Howlett
> Sent: Tuesday, June 11, 2013 6:52 AM
> To: abfab@ietf.org
> Subject: [abfab] Naming of SAML and AAA systems
> 
> I'm currently updating abfab-aaa-saml. The document is a bit unambiguous
> about the naming of system entities, specifically:
> 
>  1. There is no attempt to correlate the AAA and SAML entity naming (the
> transport and message levels respectively). I believe that we need a
naming
> convention such that it is trivial to reliably infer a system entity's AAA
or
> SAML name, given the other name.

I am not sure what this statement means.   We have defined an NAI identifier
format for use in SAML certificates so that there is a way to have common
naming for the client entities between the two systems.  Are you trying to
look at how to do naming for the AAA server and the SAML entity server?

> 
>  2. We don't yet have a mechanism for naming the functional roles of SAML
> entities within a realm, which I believe is needed to satisfy the
attribute
> request and aggregation use cases. For example, an acceptor wanting
> additional attributes for an authenticated user from realm Foo from
another
> attribute authority in realm Bar.

This is an interesting question, do you have a case where you want to do
this? 

I am also not sure how one would go about sending such a message, are you
going to use AAA for routing the SAML request based on the domain you want
to send it to?  Is there a reason to expect that the AAA server at that
location wouldn't just somehow know what to do?

Jim

> 
> Here's my proposal:
> 
>  * A SAML system names itself using an entity identifier is a URI that
encodes
> the AAA system's FQDN. For example "abfab:idp.example.com" and
> "abfab:rp.example.com" would name two hosts with FQDNs of
> idp.example.com and rp.example.com. For an RP, this entity identifier
value
> (less the abfab prefix) will therefore be equal to the value of the GSS-
> Acceptor-Host-Name RADIUS attribute. It is worth noting that section
> 4.3 of RFC3588 specifies a URI scheme for AAA protocols, but it looks a
bit
> elaborate for what we need (and possibly not complete, given the RADIUS
> transport options today). Irrespective of the convention we choose, RADIUS
> entities emitting SAML messages MUST use it.
> 
>  * SAML system entities are able to locate SAML entities within other
realms
> using RADIUS by using well-known values for the user fragment of the NAI.
> For example, a relying party would resolve an attribute authority in realm
by
> using an NAI with value "abfab:aa@example.com". This might return a SAML
> assertion issued by an entity named "abfab:idp.example.com".
> Similarly an authorisation PDP might be resolved using
> "abfab:pdp@example.com".
> 
> Opinions?
> 
> Josh.
> 
> 
> 
> Janet(UK) is a trading name of Jisc Collections and Janet Limited, a
not-for-
> profit company which is registered in England under No. 2881024 and whose
> Registered Office is at Lumen House, Library Avenue, Harwell Oxford,
Didcot,
> Oxfordshire. OX11 0SG. VAT No. 614944238
> 
> _______________________________________________
> abfab mailing list
> abfab@ietf.org
> https://www.ietf.org/mailman/listinfo/abfab