Re: [apps-discuss] [saag] HTTP authentication: the next generation

["Henry B. Hotz" <[e-mail]>]

On Dec 10, 2010, at 2:53 PM, Peter Saint-Andre wrote:

> Is it time to start thinking about next-generation authentication
> technologies for HTTP?

> 1. Way back in 2001, Keith Burdis wrote an I-D about upgrading to SASL
> within HTTP: http://tools.ietf.org/id/draft-burdis-http-sasl-00.txt

I think http://tools.ietf.org/html/draft-williams-tls-app-sasl-opt-04 is the most recent iteration on the concept.  This is at the TLS layer, not the http layer.

As Paul Hoffman said, X.509 client cert's.  In fact one could argue that's the traditional solution and that software support is already widely available.  Some organizations make this more practical by issuing the client certs with KX509.  http://tools.ietf.org/search/draft-hotz-kx509-01 (-; Comments are still desired! ;-)

http://tools.ietf.org/html/rfc4559 (Microsoft's HTTP-Negotiate)  Note that W7/2K8 add channel binding to that, but it's an incompatible upgrade, so it may not get the use it should.

There is also active work in the abfab wg which is related.  Please try to synergise, not compete with that work.

SAML Web-sso

----

IMO there are already enough options which don't do channel binding with the enclosing TLS session.  I believe any solution you propose should either do that, or should operate as part of TLS itself.

------------------------------------------------------
The opinions expressed in this message are mine,
not those of Caltech, JPL, NASA, or the US Government.
[e-mail], or [e-mail]