[abfab] New text for section 4.3.3 and 4.3.4 of draft-ietf-abfab-aaa-saml

[Alejandro Pérez Méndez <[e-mail]>]

Dear all,

at the end of this email you might find an updated text for sections 
"4.3.3 Mapping of AAA names in SAML metadata" and "4.3.4 Example of SAML 
metadata including AAA names" of our draft-ietf-abfab-aaa-saml, which I 
believe contains the decisions we agreed in the last ABFAB session in 
Prague, and in the subsequent discussion on the mailing list.

This updated proposal defines new elements of type xs:string within the 
RADIUSIDPDescriptor and RADIUSRPDescriptor elements, to describe AAA 
naming. This should remove the need for a general RADIUS URI scheme. 
Note that the RADIUSIDPService and RADIUSRPService elements, of type 
EndpointType, have been preserved in prevision of a future use.

Comments, suggestions, etc. are welcome.

Regards,
Alejandro


4.3.3.  Mapping of AAA names in SAML metadata

    This section defines the extensions to the SAML metadata
    specification [OASIS.saml-metadata-2.0-os] that are required in order
    to represent AAA names associated to a particular <EntityDescriptor>
    element.

    In SAML metadata, each single entity may act in many different roles
    in the support of multiple profiles.  This document defines two new
    roles: RADIUS IDP and RADIUS RP, requiring the declaration of two new
    subtypes of RoleDescriptorType: RADIUSIDPDescriptor and
    RADIUSRPDescriptor.  These subtypes define the additional elements
    required to represent AAA names for IDP and RP entities respectively.

4.3.3.1.  <RADIUSIDPDescriptor>

    The <RADIUSIDPDescriptor> element extends RoleDescriptorType with
    elements common to IdPs that support RADIUS.  Its
    RADIUSIDPDescriptorType complex type contains the following
    additional elements:

    <RADIUSIDPService> [Zero or More]  Zero or more elements of type
       EndpointType that describe RADIUS endpoints that are associated to
       this Entity.

    <RADIUSRealm> [Zero or More]  Zero or more elements of type xs:string
       that represent the acceptable values of the RADIUS realm
       associated to this Entity, obtained from the realm part of RADIUS
       User-Name attribute.

    The following schema fragment defines the <RADIUSIDPDescriptor>
    element and its RADIUSIDPDescriptorType complex type:

       <element name="RADIUSIDPDescriptor"
                type="md:RADIUSIDPDescriptorType"/>
           <complexType name="RADIUSIDPDescriptorType">
               <complexContent>
                   <extension base="md:RoleDescriptorType">
                       <sequence>
                           <element ref="md:RADIUSIDPService"
                                    minOccurs="0" maxOccurs="unbounded"/>
                           <element ref="md:RADIUSRealm"
                                    minOccurs="0" maxOccurs="unbounded"/>
                       </sequence>
                   </extension>
               </complexContent>
           </complexType>
       <element name="RADIUSIDPService" type="md:EndpointType"/>
       <element name="RADIUSRealm" type="xs:string"/>

                    Figure 3: RADIUSIDPDescriptor schema

4.3.3.2.  <RADIUSRPDescriptor>

    The <RADIUSRPDescriptor> element extends RoleDescriptorType with
    elements common to RPs that support RADIUS.  Its
    RADIUSRPDescriptorType complex type contains the following additional
    elements:

    <RADIUSRPService> [Zero or More]  Zero or more elements of type
       EndpointType that describe RADIUS endpoints that are associated to
       this Entity.

    <RADIUSNasIpAddress> [Zero or More]  Zero or more elements of type
       xs:string that represent the acceptable values of the RADIUS NAS-
       IP-Address attribute associated to this Entity.

    <RADIUSNasIdentifier> [Zero or More]  Zero or more elements of type
       xs:string that represent the acceptable values of the RADIUS NAS-
       Identifier attribute associated to this Entity.

    <RADIUSGssEapName> [Zero or More]  Zero or more elements of type
       xs:string that represent the acceptable values of the GSS-EAP
       acceptor name associated to this Entity.  The format for this name
       is described in section 3.1 of [RFC7055], while section 3.4
       describes how that name is decomposed and transported using RADIUS
       attributes.

    The following schema fragment defines the <RADIUSRPDescriptor>
    element and its RADIUSRPDescriptorType complex type:

       <element name="RADIUSRPDescriptor"
                type="md:RADIUSRPDescriptorType"/>
           <complexType name="RADIUSRPDescriptorType">
               <complexContent>
                   <extension base="md:RoleDescriptorType">
                       <sequence>
                           <element ref="md:RADIUSRPService"
                                    minOccurs="0" maxOccurs="unbounded"/>
                           <element ref="md:RADIUSNasIpAddress"
                                    minOccurs="0" maxOccurs="unbounded"/>
                           <element ref="md:RADIUSNasIdentifier"
                                    minOccurs="0" maxOccurs="unbounded"/>
                           <element ref="md:RADIUSGssEapName"
                                    minOccurs="0" maxOccurs="unbounded"/>
                       </sequence>
                   </extension>
               </complexContent>
           </complexType>
       <element name="RADIUSRPService" type="md:EndpointType"/>
       <element name="RADIUSNasIpAddress" type="xs:string"/>
       <element name="RADIUSNasIdentifier" type="xs:string"/>
       <element name="RADIUSGssEapName" type="xs:string"/>

                     Figure 4: RADIUSRPDescriptor schema

4.3.4.  Example of SAML metadata including AAA names

    The following figures illustrate an example of metadata including AAA
    names for and IDP and a RP respectively.  The IDP's SAML name is
    "https://IdentityProvider.com/", whereas its RADIUS realm is
    "idp.com".  The RP's SAML name is "https://RelyingParty.com/SAML",
    being its GSS-EAP acceptor name "nfs/[e-mail]".COM".

      <EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
entityID="https://IdentityProvider.com/SAML">
          <RADIUSIDPDescriptor protocolSupportEnumeration=
"urn:oasis:names:tc:SAML:2.0:protocol">
              <RADIUSRealm>
                  idp.com
              </RADIUSRealm>
          </RADIUSIDPDescriptor>
      </EntityDescriptor>

                       Figure 5: Metadata for the IDP

      <EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
entityID="https://RelyingParty.com/SAML">
          <RADIUSRPDescriptor protocolSupportEnumeration=
"urn:oasis:names:tc:SAML:2.0:protocol">
              <RADIUSGssEapName>
                  nfs/[e-mail]
              </RADIUSGssEapName>
          </RADIUSRPDescriptor>
      </EntityDescriptor>

                        Figure 6: Metadata for the RP