Re: [Id-event] SAML subject identifier type

Just clarifying the proposal as it stands today (before incorporating
Chris's input):
The following section should be added in the "Subject Identifier Types"
section:
4.9.  SAML Subject Identifier Type

   The SAML [SAML.REF] Subject Identifier Type describes a subject by
   the assertion identifier in the SAML assertion that was used to
   convey the subject's information to the Receiver.  Subject
   Identifiers of this type MUST contain an ` assertion_id"claim.  The
   value of this claim is a string that is equal to the Assertion
   Identifier in the SAML assertion.  The SAML Subject Identifier Type
   is identified by the name "saml`.

   Below is a non-normative example Subject Identifier for the SAML
   Subject Identifier Type:

   {
     "subject_type": "saml",
     "assertion_id": "_f551d88963ab4e3decb7cfe8f4dcc3f5",
   }

     Figure 8: Example: Subject Identifier for SAML Subject Identifier
                                   Type.

On Mon, Jul 13, 2020 at 1:22 PM Atul Tulshibagwale <atultulshi@google.com>
wrote:

> Hi Chris,
> I was proposing using the "assertion id" (SAML Core
> <http://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf>
> spec, line 553) in the proposal, not the "subject-id" as defined in SAML
> (spec section 3.3). The main reason was to be able to refer to a session
> that was established using a specific assertion. If it's useful, we could
> perhaps extend the SAML subject identifier type in this spec to include
> either the assertion_id or the subject_id claim.
>
> Thanks,
> Atul
>
>
> On Mon, Jul 13, 2020 at 10:30 AM Chris Phillips <Chris.Phillips@canarie.ca>
> wrote:
>
>> Hi.
>>
>> Quiet lurker observing..
>>
>> Thanks for consider the SAML elements..
>>
>>
>>
>> Atul, are you referring to the actual session identifier that someone may
>> have where the Subject-Id was exchanged OR the actual Subject-id itself in
>> your reference in the proposal with the github link?
>>
>>
>>
>> I’m trying to square what I see on the git delta on line 294-296 in
>> https://github.com/richanna/secevent/pull/1/commits/b20b6692eb50628927476ca78f9be077ace88994
>>
>>
>>
>>
>>
>> And a Subject-id as shown in the example in 3.3.3 here:
>> https://docs.oasis-open.org/security/saml-subject-id-attr/v1.0/cs01/saml-subject-id-attr-v1.0-cs01.html#_Toc536097229
>>
>>
>>
>> What you offered in the example is not a Subject-id  per the OASIS SAML
>> spec as written in section 3.3.1
>>
>>
>>
>> Am I mis-interpreting something?
>>
>>
>>
>> C
>>
>>
>>
>>
>>
>> *From: *Id-event <id-event-bounces@ietf.org> on behalf of Atul
>> Tulshibagwale <atultulshi=40google.com@dmarc.ietf.org>
>> *Date: *Monday, July 13, 2020 at 12:17 PM
>> *To: *"id-event@ietf.org" <id-event@ietf.org>
>> *Subject: *[Id-event] SAML subject identifier type
>>
>>
>>
>> Hi all,
>>
>> Based on the discussions in the SSE working group within the OpenID
>> Foundation, we would like to propose that the subject identifier
>> specification include a SAML subject identifier type. This is so that
>> sessions established across peers using SAML may be identified in events
>> that include the subject identifier.
>>
>>
>>
>>  A SAML subject identifier has only one claim within it, the assertion id
>> of the SAML assertion used to establish the single sign-on session.
>>
>>
>>
>> This change is also included in my proposal here
>> <https://github.com/richanna/secevent/pull/1>.
>>
>>
>>
>> Thanks,
>>
>> Atul
>>
>>
>> _______________________________________________
>> Id-event mailing list
>> Id-event@ietf.org
>> https://www.ietf.org/mailman/listinfo/id-event
>>
>