Re: [KAML] latest status

"Henry B. Hotz" <hotz@jpl.nasa.gov> Wed, 28 October 2009 00:35 UTC

Return-Path: <hotz@jpl.nasa.gov>
X-Original-To: kaml@core3.amsl.com
Delivered-To: kaml@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id F18F63A69E6 for <kaml@core3.amsl.com>; Tue, 27 Oct 2009 17:35:22 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -6.599
X-Spam-Level:
X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1O5l7pTKmSFr for <kaml@core3.amsl.com>; Tue, 27 Oct 2009 17:35:21 -0700 (PDT)
Received: from mail.jpl.nasa.gov (smtp.jpl.nasa.gov [128.149.139.106]) by core3.amsl.com (Postfix) with ESMTP id E5D3A3A69D8 for <kaml@ietf.org>; Tue, 27 Oct 2009 17:35:21 -0700 (PDT)
Received: from mprox1.jpl.nasa.gov (mprox1.jpl.nasa.gov [137.78.160.140]) by smtp.jpl.nasa.gov (Switch-3.4.1/Switch-3.4.1) with ESMTP id n9S0ZXn5008587; Tue, 27 Oct 2009 17:35:33 -0700
Received: from laphotz.jpl.nasa.gov (laphotz.jpl.nasa.gov [128.149.133.44]) by mprox1.jpl.nasa.gov (Switch-3.2.6/Switch-3.2.6) with ESMTP id n9S0ZVsJ030721 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT); Tue, 27 Oct 2009 17:35:32 -0700
Message-Id: <9E4C1310-430D-44A4-B10F-38F47B5C9E4F@jpl.nasa.gov>
From: "Henry B. Hotz" <hotz@jpl.nasa.gov>
To: Luke Howard <lukeh@PADL.COM>
In-Reply-To: <B4275EF3-278C-4CB0-875D-E284BCCF8C9D@padl.com>
Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes
Content-Transfer-Encoding: 7bit
Mime-Version: 1.0 (Apple Message framework v936)
Date: Tue, 27 Oct 2009 17:35:31 -0700
References: <46fc8a10909180713x3116deb5l2cfade36f6b85a2e@mail.gmail.com> <0AC447C8-C281-4432-BC43-93FD295B8FDC@jpl.nasa.gov> <B4275EF3-278C-4CB0-875D-E284BCCF8C9D@padl.com>
X-Mailer: Apple Mail (2.936)
X-Source-IP: laphotz.jpl.nasa.gov [128.149.133.44]
X-Source-Sender: hotz@jpl.nasa.gov
X-AUTH: Authorized
Cc: kaml@ietf.org, Stephen C Buckley <sbuckley@MIT.EDU>
Subject: Re: [KAML] latest status
X-BeenThere: kaml@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Discussions about SAML and Kerberos intersections <kaml.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/kaml>, <mailto:kaml-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/kaml>
List-Post: <mailto:kaml@ietf.org>
List-Help: <mailto:kaml-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/kaml>, <mailto:kaml-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 28 Oct 2009 00:35:23 -0000

On Sep 19, 2009, at 11:05 AM, Luke Howard wrote:

>> I think there is interest in solving the authorization problem in a
>> way that scales better than the MS PAC.  There's interest on
>> Microsoft's part as well.  Nobody's come up with a solution that
>> enough people find attractive though.
>
> I'm interested in this, when I get some cycles to work on it.  The GSS
> naming extensions and S4U projects recently committed to MIT will
> help, also I've created a couple of placeholder projects at:
>
> 	http://k5wiki.kerberos.org/wiki/Projects/SAMLInKerberos

Just looked at this.  Added a minor comment, which I think is implied  
by what I've already said on this list.

> 	http://k5wiki.kerberos.org/wiki/Projects/KerberosInSAML

This one's still empty.  I assume the issue is how to relate principal  
names to SAML subject names?

> Last I heard from MS (earlier this week), they are moving towards
> claims-based authorisation but are undecided whether they will support
> claims with "legacy" services such as the file server, and thus
> whether they will support claims in the PAC. (This statement was
> couched in very vague terms, so I might be misinterpreting.)

Reiterated last week (from now).  Don't recall if they were any clearer.

> Their whitepapers on Geneva are worth reading, too:
>
> http://www.microsoft.com/downloads/details.aspx?FamilyID=9ca5c685-3172-4d8f-81cb-1a59bdc9f7e3&displaylang=en
>
> -- Luke

------------------------------------------------------
The opinions expressed in this message are mine,
not those of Caltech, JPL, NASA, or the US Government.
Henry.B.Hotz@jpl.nasa.gov, or hbhotz@oxy.edu