Re: [KAML] Re: Chicago bar-BOF summary

On 9/6/07, Douglas E. Engert <deengert@anl.gov> wrote:
> Tom Scavo wrote:
> >
> > FWIW, we are embedding SAML assertions in short-lived X.509
> > certificates
>
> So you are talking RFC3820 proxy certificates?

Yes, we have a tool that issues a proxy certificate with a SAML
assertion bound to a non-critical certificate extension.  We also have
an online CA that issues short-lived end entity certificates with a
similar extension.

> One problem is that PKINIT today does use any of these assertions
> when issuing a TGT, and does not forward these assertions in the TGT.
> Thus my suggestion of passing the cert and chain in the TGT.
>
> Now if SAML processing is added to the KDC, maybe it should pass
> along any SAML assertions found in the cert cert chain rather then
> the full cert.

Again, just to illustrate our particular use of SAML, the relying
party traverses the certificate chain up to the first
non-impersonation proxy (which in practice is usually the EEC) and
consumes any and all bound SAML assertions.  So multiple assertions
may be involved, from multiple SAML issuers.

Tom Scavo
NCSA

_______________________________________________
KAML mailing list
KAML@ietf.org
https://www1.ietf.org/mailman/listinfo/kaml