Re: [abfab] Review of draft-ietf-abfab-aaa-saml-11

[Alejandro Pérez Méndez <[e-mail]>]

El 16/10/15 a las 14:55, Sam Hartman escribió:
>>>>>> "Alejandro" == Alejandro Pérez Méndez <[e-mail]> writes:
>      Alejandro> Hi Scott, thanks for this thorough review. See my
>      Alejandro> comments inline.
>
>      >> Sorry this is a little late. I gave it a pretty thorough read.
>      >>
>      >> Substantive:
>      >>
>      >> Is it useful to say something in section 3 along the lines that
>      >> apart from the binding defined in section 4, the spec doesn't
>      >> prescribe any particular pattern/usage/constraint/etc. on the use
>      >> of the two RADIUS attributes it defines? I ask because of the
>      >> statement in section 4 about the two attributes not being used in
>      >> the same RADIUS message, and wondered if that should be stated in
>      >> section 3, but then thought maybe that wasn't something being
>      >> constrained by the spec, but just the binding.
>
>      Alejandro> I think that it would make sense to move the restriction
>      Alejandro> up to section 3, as one can see both attributes as
>      Alejandro> exclusive alternatives to represent SAML information. If
>      Alejandro> the RADIUS server decides to send a SAML Message, why
>      Alejandro> sending a SAML Assertion aside?
>
> Agreed.
>
>      Alejandro> I didn't write that text, so we have to hear the original
>      Alejandro> authors' opinion here. I guess the point was that the
>      Alejandro> SAML error response is optional, and that the RADIUS
>      Alejandro> server, in presence of SAML errors, can just limit to
>      Alejandro> provide a RADIUS-only response.
>
> Yes, that's the intent as I understand it.
>
>      Alejandro> Nevertheless, I think the last two paragraphs of section
>      Alejandro> 4.2 could be reduced to the following text, it the
>      Alejandro> original authors agree:
>
>      Alejandro>    "In the case of a SAML processing error, the RADIUS
>      Alejandro> server MAY include a SAML response message with an
>      Alejandro> appropriate value for the <samlp:Status> element within
>      Alejandro> the Access-Accept or Access-Reject packet to notify this
>      Alejandro> fact to the Client.".
>
> I think the following would be more clear:
>
>      "In the case of a SAML processing error, the RADIUS
>   server MAY include a SAML response message with an
>   appropriate value for the <samlp:Status> element within
>   the Access-Accept or Access-Reject packet to notify the client.
>   Alternatively, the RADIUS server can respond without a SAML-Message attribute.".

That sounds better, yes.

>
> Or did we end up calling it SAML-Protocol?

Oh, right. I'll change that.

Regards,
Alejandro

>
> --Sam