RE: [KAML] Reminder: BOF proposals to me by October 1

Tom Scavo wrote:
> On 9/25/07, Leif Johansson <leifj@it.su.se> wrote:
> > Paul Rabinovich wrote:
> > >
> > >       IMO it's preferable to keep the LoA piece under the 
> Kerberos 
> > > WG rather than under the KAML WG since - in the short-term - 
> > > out-of-the-box SAML 2.0 seems not to be able to help with LoA. 
> > > Whatever we design, however,
> > >
> > I think you are wrong. There are at least two ways to model 
> LoA using 
> > SAML - using an AC class or using an attribute.
> 
> That's correct.  If you decide to use AuthnContext, that 
> means the Kerberos-bound SAML assertion would contain an 
> AuthnStatement.  On the other hand, an Attribute would 
> require an AttributeStatement.
> (Personally, I think AuthnContext is the way to go for LoA, 
> but the jury's still out on that issue.)

I don't think that it's desirable to prescribe either (1) what
constitutes an appropriate token for LoA or (2) that a token needs to be
bound directly to the ticket. The former *should* be a matter for local
policy, and the latter is not necessary.

Just provide a mechanism for the Relying Party to resolve the
Authentication and Attribute Authorities associated with the principal
wielding the ticket and the Relying Party can make a call-back to one or
the other, or both, depending on what its own local authorisation policy
considers an appropriate LoA token, and make the necessary Assertion
Request(s) itself.

An example mechanism that might support this: treat the principal name
as a NameID (which SAML already allows) and the Relying Party can use
SAMLMeta DNS Publication and Resolution (Sec 4.2) with the NID2U
servicefield in a NAPTR record to specify the AuthN and/or Attr
Authorities associated with it (see Sec 4.2.2.2 for an analagous
example).

	Client		TGS		Service		DNS
SAML AA (AuthN and/or Attr)

		----TKT?---->
		<---TKT------
	      -----------TKT--------->
						Validate TKT
							--Look up-->

NAPTR record
							<--SAML AA--
							--------SAML
Assrt Req--->
							<-------SAML
Assrt Res----
						AuthZ decision
		<-------Ok--------------
josh.

JANET(UK) is a trading name of The JNT Association, a company limited
by guarantee which is registered in England under No. 2881024 
and whose Registered Office is at Lumen House, Library Avenue,
Harwell Science and Innovation Campus, Didcot, Oxfordshire. OX11 0SG

_______________________________________________
KAML mailing list
KAML@ietf.org
https://www1.ietf.org/mailman/listinfo/kaml