Re: [Id-event] SAML subject identifier type

Hi Chris,
I was proposing using the "assertion id" (SAML Core
<http://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf> spec,
line 553) in the proposal, not the "subject-id" as defined in SAML (spec
section 3.3). The main reason was to be able to refer to a session that was
established using a specific assertion. If it's useful, we could perhaps
extend the SAML subject identifier type in this spec to include either the
assertion_id or the subject_id claim.

Thanks,
Atul

On Mon, Jul 13, 2020 at 10:30 AM Chris Phillips <Chris.Phillips@canarie.ca>
wrote:

> Hi.
>
> Quiet lurker observing..
>
> Thanks for consider the SAML elements..
>
>
>
> Atul, are you referring to the actual session identifier that someone may
> have where the Subject-Id was exchanged OR the actual Subject-id itself in
> your reference in the proposal with the github link?
>
>
>
> I’m trying to square what I see on the git delta on line 294-296 in
> https://github.com/richanna/secevent/pull/1/commits/b20b6692eb50628927476ca78f9be077ace88994
>
>
>
>
>
> And a Subject-id as shown in the example in 3.3.3 here:
> https://docs.oasis-open.org/security/saml-subject-id-attr/v1.0/cs01/saml-subject-id-attr-v1.0-cs01.html#_Toc536097229
>
>
>
> What you offered in the example is not a Subject-id  per the OASIS SAML
> spec as written in section 3.3.1
>
>
>
> Am I mis-interpreting something?
>
>
>
> C
>
>
>
>
>
> *From: *Id-event <id-event-bounces@ietf.org> on behalf of Atul
> Tulshibagwale <atultulshi=40google.com@dmarc.ietf.org>
> *Date: *Monday, July 13, 2020 at 12:17 PM
> *To: *"id-event@ietf.org" <id-event@ietf.org>
> *Subject: *[Id-event] SAML subject identifier type
>
>
>
> Hi all,
>
> Based on the discussions in the SSE working group within the OpenID
> Foundation, we would like to propose that the subject identifier
> specification include a SAML subject identifier type. This is so that
> sessions established across peers using SAML may be identified in events
> that include the subject identifier.
>
>
>
>  A SAML subject identifier has only one claim within it, the assertion id
> of the SAML assertion used to establish the single sign-on session.
>
>
>
> This change is also included in my proposal here
> <https://github.com/richanna/secevent/pull/1>.
>
>
>
> Thanks,
>
> Atul
>
>
> _______________________________________________
> Id-event mailing list
> Id-event@ietf.org
> https://www.ietf.org/mailman/listinfo/id-event
>