Re: [KAML] latest status

["Henry B. Hotz" <[e-mail]>]

On Sep 19, 2009, at 11:05 AM, Luke Howard wrote:

>> I think there is interest in solving the authorization problem in a
>> way that scales better than the MS PAC.  There's interest on
>> Microsoft's part as well.  Nobody's come up with a solution that
>> enough people find attractive though.
>
> I'm interested in this, when I get some cycles to work on it.  The GSS
> naming extensions and S4U projects recently committed to MIT will
> help, also I've created a couple of placeholder projects at:
>
> 	http://k5wiki.kerberos.org/wiki/Projects/SAMLInKerberos

Just looked at this.  Added a minor comment, which I think is implied  
by what I've already said on this list.

> 	http://k5wiki.kerberos.org/wiki/Projects/KerberosInSAML

This one's still empty.  I assume the issue is how to relate principal  
names to SAML subject names?

> Last I heard from MS (earlier this week), they are moving towards
> claims-based authorisation but are undecided whether they will support
> claims with "legacy" services such as the file server, and thus
> whether they will support claims in the PAC. (This statement was
> couched in very vague terms, so I might be misinterpreting.)

Reiterated last week (from now).  Don't recall if they were any clearer.

> Their whitepapers on Geneva are worth reading, too:
>
> http://www.microsoft.com/downloads/details.aspx?FamilyID=9ca5c685-3172-4d8f-81cb-1a59bdc9f7e3&displaylang=en
>
> -- Luke

------------------------------------------------------
The opinions expressed in this message are mine,
not those of Caltech, JPL, NASA, or the US Government.
[e-mail], or [e-mail]