Re: [abfab] Direction Forward for aaa-saml

Leif Johansson <leifj@mnt.se> Wed, 22 July 2015 10:09 UTC

Return-Path: <leifj@mnt.se>
X-Original-To: abfab@ietfa.amsl.com
Delivered-To: abfab@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DBACA1AD0C8 for <abfab@ietfa.amsl.com>; Wed, 22 Jul 2015 03:09:50 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.6
X-Spam-Level:
X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sEYJ7uF8myJc for <abfab@ietfa.amsl.com>; Wed, 22 Jul 2015 03:09:47 -0700 (PDT)
Received: from mail-wi0-f182.google.com (mail-wi0-f182.google.com [209.85.212.182]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 907431AD0A6 for <abfab@ietf.org>; Wed, 22 Jul 2015 03:09:47 -0700 (PDT)
Received: by wicgb10 with SMTP id gb10so90842379wic.1 for <abfab@ietf.org>; Wed, 22 Jul 2015 03:09:46 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:content-type:mime-version:subject:from :in-reply-to:date:cc:content-transfer-encoding:message-id:references :to; bh=vHTFUJOURMLDxEIUZB+XDeplvcFBOHjot+9fo7dG0tE=; b=ew5COe8b0e2gS/12OvyHlyMM38XGiCXq3Zk8l+2iP/ybuSYsaRqwH1o0euBZHVriep 3k5PbmfIKwP5jlFENLfJFO4j9pOdh1us6JCtNQD3dqUekpQjsAQvWHz9B+o5tL+FyDCb N6SeP6AraxzNfLQHlRr5iC8D8cC7gskNkhvpVj89ajvAYSozXAqbEDDXUSKZoD4j6VoH T+6rB0HhnnlJh8DmgReiXb7TLWNj9WdMNh7yJak3GmLgxJNi3mp2bW77mNQ0MRg3EdpP JZCY6qZdsTrn1rCroSZQPJLICk3okkjll9jRttD+LKO+I7vIj0oH2I5eSrqJP/2aizXh fPQA==
X-Gm-Message-State: ALoCoQmhvyGpb79ujacM5p2jH7wLfXeXEgmX+vWlG3fzLq9DEYuo73yCnd3hu4wBlUnhQUri23p7
X-Received: by 10.194.23.167 with SMTP id n7mr3374705wjf.112.1437559786201; Wed, 22 Jul 2015 03:09:46 -0700 (PDT)
Received: from [31.133.155.46] (dhcp-9b2e.meeting.ietf.org. [31.133.155.46]) by smtp.gmail.com with ESMTPSA id ft5sm21240032wib.4.2015.07.22.03.09.44 (version=TLSv1/SSLv3 cipher=OTHER); Wed, 22 Jul 2015 03:09:45 -0700 (PDT)
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (1.0)
From: Leif Johansson <leifj@mnt.se>
X-Mailer: iPhone Mail (12H143)
In-Reply-To: <tslwpxsy0ql.fsf@mit.edu>
Date: Wed, 22 Jul 2015 12:09:44 +0200
Content-Transfer-Encoding: 7bit
Message-Id: <8E4E5965-0E43-4ABD-8853-8A6C7C6926C5@mnt.se>
References: <tslwpxsy0ql.fsf@mit.edu>
To: Sam Hartman <hartmans@painless-security.com>
Archived-At: <http://mailarchive.ietf.org/arch/msg/abfab/ebBr-sgkG-k9CQljqi474aFkGX8>
Cc: "abfab@ietf.org" <abfab@ietf.org>
Subject: Re: [abfab] Direction Forward for aaa-saml
X-BeenThere: abfab@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "Application Bridging, Federated Authentication Beyond \(the web\)" <abfab.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/abfab>, <mailto:abfab-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/abfab/>
List-Post: <mailto:abfab@ietf.org>
List-Help: <mailto:abfab-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/abfab>, <mailto:abfab-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 22 Jul 2015 10:09:51 -0000


> 22 jul 2015 kl. 11:56 skrev Sam Hartman <hartmans@painless-security.com>om>:
> 
> Leif, I wanted to write up my understanding of our proposed direction
> forward, just in case things take longer than we anticipate  to
> implement.
> 
> During the meeting  Monday we discussed Alejandro's proposal.
> 
> He proposes adding two new role descriptor subtypes: Radiusidpdescriptor
> and Radiusrpdescriptor.
> That seems great.
> 
> He proposes adding a RadiusIdpService and RadiusRpService of
> EndpointType as well.
> 
> In the meeting we discussed that we really aren't specifying an
> edpoint.  In particular, the location of the service is implicit in this
> RADIUS binding.  It's possible we might describe something in the future
> where we included radsec endpoints and keys in metadata, but that's not
> what we need now.

agree but it may be cheap/easy to include that upfront

not critical though

> 
> However we also discovered that a role descriptor doesn't actually need
> any EndpointType subclasses.  So, instead, Alejandro will create a
> different extension to rolldescriptor to include the naming information
> we need.
> 
> This will allow us to avoid registering an unresolvable URI to describe
> the security name of a RADIUS entity.
> 
> Have I accurately summarized what we discussed?
> If so, I'd like to solicit any comments from the list.
> 

matches my recollection

> --Sam
> 
> _______________________________________________
> abfab mailing list
> abfab@ietf.org
> https://www.ietf.org/mailman/listinfo/abfab