[abfab] Naming of SAML and AAA systems

[Josh Howlett <[e-mail]>]

I'm currently updating abfab-aaa-saml. The document is a bit unambiguous
about the naming of system entities, specifically:

 1. There is no attempt to correlate the AAA and SAML entity naming (the
transport and message levels respectively). I believe that we need a
naming convention such that it is trivial to reliably infer a system
entity's AAA or SAML name, given the other name.

 2. We don't yet have a mechanism for naming the functional roles of SAML
entities within a realm, which I believe is needed to satisfy the
attribute request and aggregation use cases. For example, an acceptor
wanting additional attributes for an authenticated user from realm Foo
from another attribute authority in realm Bar.

Here's my proposal:

 * A SAML system names itself using an entity identifier is a URI that
encodes the AAA system's FQDN. For example "abfab:idp.example.com" and
"abfab:rp.example.com" would name two hosts with FQDNs of idp.example.com
and rp.example.com. For an RP, this entity identifier value (less the
abfab prefix) will therefore be equal to the value of the
GSS-Acceptor-Host-Name RADIUS attribute. It is worth noting that section
4.3 of RFC3588 specifies a URI scheme for AAA protocols, but it looks a
bit elaborate for what we need (and possibly not complete, given the
RADIUS transport options today). Irrespective of the convention we choose,
RADIUS entities emitting SAML messages MUST use it.

 * SAML system entities are able to locate SAML entities within other
realms using RADIUS by using well-known values for the user fragment of
the NAI. For example, a relying party would resolve an attribute authority
in realm by using an NAI with value "abfab:[e-mail]". This might
return a SAML assertion issued by an entity named "abfab:idp.example.com".
Similarly an authorisation PDP might be resolved using
"abfab:[e-mail]".

Opinions?

Josh.



Janet(UK) is a trading name of Jisc Collections and Janet Limited, a 
not-for-profit company which is registered in England under No. 2881024 
and whose Registered Office is at Lumen House, Library Avenue,
Harwell Oxford, Didcot, Oxfordshire. OX11 0SG. VAT No. 614944238