Re: [Id-event] SAML subject identifier type
Yaron Sheffer <yaronf.ietf@gmail.com> Tue, 14 July 2020 19:32 UTC
Return-Path: <yaronf.ietf@gmail.com>
X-Original-To: id-event@ietfa.amsl.com
Delivered-To: id-event@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 781233A09BA for <id-event@ietfa.amsl.com>; Tue, 14 Jul 2020 12:32:18 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.97
X-Spam-Level:
X-Spam-Status: No, score=-1.97 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, MALFORMED_FREEMAIL=0.116, MIME_QP_LONG_LINE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_FILL_THIS_FORM_SHORT=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QXhNr9BnBEN0 for <id-event@ietfa.amsl.com>; Tue, 14 Jul 2020 12:32:16 -0700 (PDT)
Received: from mail-wr1-x432.google.com (mail-wr1-x432.google.com [IPv6:2a00:1450:4864:20::432]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6B7593A0CEC for <id-event@ietf.org>; Tue, 14 Jul 2020 12:32:00 -0700 (PDT)
Received: by mail-wr1-x432.google.com with SMTP id s10so24269016wrw.12 for <id-event@ietf.org>; Tue, 14 Jul 2020 12:32:00 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=user-agent:date:subject:from:to:cc:message-id:thread-topic :references:in-reply-to:mime-version; bh=RfLr4fFEI1taX2L8Z/RO47jyZ7Cqz9sAR2T0WZn7Ce8=; b=tgZjZOGLkwoI5N/ViA6Lvs5sBT279idUa6BeU3cXxWJ/KHml4Q/agQMYfZQHvl3fi0 b9BruP4MGeuVitrsSSGtUi7j9zwO8UYPD0JOPtxsDaUrHpUcNR7rRx5O11SudLFMlaOr tHidXh/bZtSV8yDYbatF2JJRKe2CZ4MTP0B4+Dukz9bnHRKiB5FNdaOuH+nniREdQ/u5 uyVLzU7RvQSc3c8PVfXEArFu2Je717uy/UKhWJn5dTVM6esV8UQSrvWYAPU9IicpTG6t buCYbPdg9BKq6dDs+b9Ud4dvWVPpIlJSYxUD5N7lxivUJwJb9okcce8IfjSKeGzjMRV8 D6/w==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:user-agent:date:subject:from:to:cc:message-id :thread-topic:references:in-reply-to:mime-version; bh=RfLr4fFEI1taX2L8Z/RO47jyZ7Cqz9sAR2T0WZn7Ce8=; b=LEvUPOZCPiR+dZUnhHyGsQoZ+37pp/59hqYjMcqO6mVce0tivyW+tdLDlPLn5emDBJ CDrbsjbgfn30roVDleTrfuPexnRwWNUamRlzYe8kJ1ogwdasJQ4v+M19QwgriRellUzs GJ02E4kytbb9heEhJVxaSHSRqauFjy/nW9Iyhynfp4VasfQR3Pt2z7u7jAS3KEpQY2L7 sm7wpioTf4hndhgIrfCJboVL74BVSHgihsC7nEBaTLTmArtqNH+SICsWqlSq/zpYRauy HlobKsVZbr2XAg85YZTXrRp/0epkxqf9bWK5rE/ahU211Anx0hkAfQCsK+zQE/6YczYo r2FA==
X-Gm-Message-State: AOAM530Esu376pBf3WngfzAUd1jHAbjDr1Pd/s2ByhMkL9e4JY8PTgLm covM2yBReseBaE9qBG8xHVA=
X-Google-Smtp-Source: ABdhPJwWYq6gIzavfDOqzKqAV5UJE84GViLseND9Wcw8jZ4gmRb+Ye/si8+JmBD1YcCew+uuPyuwxg==
X-Received: by 2002:a5d:5187:: with SMTP id k7mr8139603wrv.39.1594755118917; Tue, 14 Jul 2020 12:31:58 -0700 (PDT)
Received: from [172.26.49.35] (pub-corp-42-8.intuit.com. [91.102.42.8]) by smtp.gmail.com with ESMTPSA id w7sm5991502wmc.32.2020.07.14.12.31.57 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Tue, 14 Jul 2020 12:31:58 -0700 (PDT)
User-Agent: Microsoft-MacOutlook/16.38.20061401
Date: Tue, 14 Jul 2020 22:31:56 +0300
From: Yaron Sheffer <yaronf.ietf@gmail.com>
To: Atul Tulshibagwale <atultulshi=40google.com@dmarc.ietf.org>, Chris Phillips <Chris.Phillips@canarie.ca>
CC: "id-event@ietf.org" <id-event@ietf.org>
Message-ID: <E7D14134-0210-4515-ACA3-2AB5CDDCBF34@gmail.com>
Thread-Topic: [Id-event] SAML subject identifier type
References: <CAMCkG5thP1JnyBn5qAK0TLqBoa-y53Qnoq=mf-NPLfzSF2U7VQ@mail.gmail.com> <5B3455F1-9F82-40C5-BE22-2E3B715A0CF1@canarie.ca> <CAMCkG5uSQzTGCmFn6DLeXVbA0B0wrcPou8CEjtCQ5BCp3M+eOw@mail.gmail.com> <CAMCkG5uff+WwMRLDr+Lph-TagtwL5jWORg5ruvWLOxkNBM2s0A@mail.gmail.com>
In-Reply-To: <CAMCkG5uff+WwMRLDr+Lph-TagtwL5jWORg5ruvWLOxkNBM2s0A@mail.gmail.com>
Mime-version: 1.0
Content-type: multipart/alternative; boundary="B_3677610717_1125105698"
Archived-At: <https://mailarchive.ietf.org/arch/msg/id-event/mgqEnxeej1f_F1EbrDZcsQMG_Ao>
Subject: Re: [Id-event] SAML subject identifier type
X-BeenThere: id-event@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." <id-event.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/id-event>, <mailto:id-event-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/id-event/>
List-Post: <mailto:id-event@ietf.org>
List-Help: <mailto:id-event-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/id-event>, <mailto:id-event-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 14 Jul 2020 19:32:18 -0000
I need a lot more context here. So far, subject IDs have denoted durable entities, such as email addresses, phone numbers, account. This is adding a subject ID that denotes an ephemeral entity, basically similar to a session ID. This looks weird from an architectural point of view, and also begs the question, why specifically SAML and not other session types. Thanks, Yaron From: Id-event <id-event-bounces@ietf.org> on behalf of Atul Tulshibagwale <atultulshi=40google.com@dmarc.ietf.org> Date: Tuesday, July 14, 2020 at 00:14 To: Chris Phillips <Chris.Phillips@canarie.ca> Cc: "id-event@ietf.org" <id-event@ietf.org> Subject: Re: [Id-event] SAML subject identifier type Just clarifying the proposal as it stands today (before incorporating Chris's input): The following section should be added in the "Subject Identifier Types" section: 4.9. SAML Subject Identifier Type The SAML [SAML.REF] Subject Identifier Type describes a subject by the assertion identifier in the SAML assertion that was used to convey the subject's information to the Receiver. Subject Identifiers of this type MUST contain an ` assertion_id"claim. The value of this claim is a string that is equal to the Assertion Identifier in the SAML assertion. The SAML Subject Identifier Type is identified by the name "saml`. Below is a non-normative example Subject Identifier for the SAML Subject Identifier Type: { "subject_type": "saml", "assertion_id": "_f551d88963ab4e3decb7cfe8f4dcc3f5", } Figure 8: Example: Subject Identifier for SAML Subject Identifier Type. On Mon, Jul 13, 2020 at 1:22 PM Atul Tulshibagwale <atultulshi@google.com> wrote: Hi Chris, I was proposing using the "assertion id" (SAML Core spec, line 553) in the proposal, not the "subject-id" as defined in SAML (spec section 3.3). The main reason was to be able to refer to a session that was established using a specific assertion. If it's useful, we could perhaps extend the SAML subject identifier type in this spec to include either the assertion_id or the subject_id claim. Thanks, Atul On Mon, Jul 13, 2020 at 10:30 AM Chris Phillips <Chris.Phillips@canarie.ca> wrote: Hi. Quiet lurker observing.. Thanks for consider the SAML elements.. Atul, are you referring to the actual session identifier that someone may have where the Subject-Id was exchanged OR the actual Subject-id itself in your reference in the proposal with the github link? I’m trying to square what I see on the git delta on line 294-296 in https://github.com/richanna/secevent/pull/1/commits/b20b6692eb50628927476ca78f9be077ace88994 And a Subject-id as shown in the example in 3.3.3 here: https://docs.oasis-open.org/security/saml-subject-id-attr/v1.0/cs01/saml-subject-id-attr-v1.0-cs01.html#_Toc536097229 What you offered in the example is not a Subject-id per the OASIS SAML spec as written in section 3.3.1 Am I mis-interpreting something? C From: Id-event <id-event-bounces@ietf.org> on behalf of Atul Tulshibagwale <atultulshi=40google.com@dmarc.ietf.org> Date: Monday, July 13, 2020 at 12:17 PM To: "id-event@ietf.org" <id-event@ietf.org> Subject: [Id-event] SAML subject identifier type Hi all, Based on the discussions in the SSE working group within the OpenID Foundation, we would like to propose that the subject identifier specification include a SAML subject identifier type. This is so that sessions established across peers using SAML may be identified in events that include the subject identifier. A SAML subject identifier has only one claim within it, the assertion id of the SAML assertion used to establish the single sign-on session. This change is also included in my proposal here. Thanks, Atul _______________________________________________ Id-event mailing list Id-event@ietf.org https://www.ietf.org/mailman/listinfo/id-event _______________________________________________ Id-event mailing list Id-event@ietf.org https://www.ietf.org/mailman/listinfo/id-event
- [Id-event] SAML subject identifier type Atul Tulshibagwale
- Re: [Id-event] SAML subject identifier type Chris Phillips
- Re: [Id-event] SAML subject identifier type Atul Tulshibagwale
- Re: [Id-event] SAML subject identifier type Atul Tulshibagwale
- Re: [Id-event] SAML subject identifier type Yaron Sheffer
- Re: [Id-event] SAML subject identifier type Atul Tulshibagwale
- Re: [Id-event] SAML subject identifier type Yaron Sheffer
- Re: [Id-event] SAML subject identifier type Brian Campbell
- Re: [Id-event] SAML subject identifier type Atul Tulshibagwale
- Re: [Id-event] SAML subject identifier type Atul Tulshibagwale
- Re: [Id-event] SAML subject identifier type Richard Backman, Annabelle
- Re: [Id-event] SAML subject identifier type Atul Tulshibagwale
- Re: [Id-event] SAML subject identifier type Richard Backman, Annabelle
- Re: [Id-event] SAML subject identifier type Mike Jones
- Re: [Id-event] SAML subject identifier type Dick Hardt
- Re: [Id-event] SAML subject identifier type Atul Tulshibagwale
- Re: [Id-event] SAML subject identifier type Brian Campbell
- Re: [Id-event] SAML subject identifier type Mike Jones