RE: [KAML] Chicago bar-BOF summary

Leif Johansson wrote:
> Josh Howlett wrote:
> > I'm curious whether we can use SAML, and the trust fabrics that are
> > realised through SAML federation metadata, to support some kind of
> > cross-realm Kerberos operation - perhaps using a SAML-based 
> profile for
> > inter-KDC communication (following PKCROSS' example)?
> >
> > The use-case would be a visitor requiring access to some local
> > Kerberos-protected network resource, but no local credentials.
> >   
> Did you read draft-sakane-krb-cross-problem-statement? It looks
> like you may be describing something related to 5.6 (in version 03)

Not quite - I'm assuming that the user has contacted his KDC. A better
description is 5.3 'Scalability of the direct trust model'.

> > However, such a profile might also provide a way to avoid 
> using the Web
> > SSO Profile (in a browser context, obviously) and therefore 
> side-step
> > the associated IdP "discovery problem". The browser could 
> authenticate
> > using Negotiate (anonymously/pseudonymously) to the SP; 
> authorisation
> > could subsequently be performed using the familiar SAML-based
> > mechanisms; perhaps boot-strapped through an artifact 
> returned in the
> > PAC (which is used as the discovery 'cue').
> >
> > best regards, josh.
> >   
> I guess its not so much side-stepping IdP discovery as it is using
> the IdP discovery which has already happened.

Yes, that's a better description.

FWIW, I think this is just a generalisation of the "WebSSO kerberos
n-tier problem" in a cross-realm context. Does that make sense? :-)

josh.

_______________________________________________
KAML mailing list
KAML@ietf.org
https://www1.ietf.org/mailman/listinfo/kaml