RE: [KAML] Reminder: BOF proposals to me by October 1

> > > That's correct.  If you decide to use AuthnContext, that 
> means the 
> > > Kerberos-bound SAML assertion would contain an 
> AuthnStatement.  On 
> > > the other hand, an Attribute would require an AttributeStatement.
> > > (Personally, I think AuthnContext is the way to go for 
> LoA, but the 
> > > jury's still out on that issue.)
> >
> > I don't think that it's desirable to prescribe either (1) what 
> > constitutes an appropriate token for LoA or (2) that a 
> token needs to 
> > be bound directly to the ticket. The former *should* be a 
> matter for 
> > local policy, and the latter is not necessary.
> 
> With regard to (1), I think you're missing the point, Josh.  
> How the LoA is carried in the SAML assertion is a technical 
> detail, not a matter of policy.

My point was that if the <LoA token> can be acquired post hoc then the
Relying Party can decide itself what is the necessary token(s), rather
than relying on the TGS to choose what it believes is appropriate. The
fire-and-forget approach does not provide room for agility.

I believe that what constitutes an appropriate <LoA token> depends on
what the Relying Party in question feels is necessary to satisfy their
policy, and so binding these semantics arbitrarily to the transport
protocol seems unnecessarily restrictive. Let them choose! AuthN
context, attribute or moon phase....

josh.

JANET(UK) is a trading name of The JNT Association, a company limited
by guarantee which is registered in England under No. 2881024 
and whose Registered Office is at Lumen House, Library Avenue,
Harwell Science and Innovation Campus, Didcot, Oxfordshire. OX11 0SG

_______________________________________________
KAML mailing list
KAML@ietf.org
https://www1.ietf.org/mailman/listinfo/kaml