Re: [KAML] Reminder: BOF proposals to me by October 1

On Nov 15, 2007 4:40 AM, Josh Howlett <Josh.Howlett@ja.net> wrote:
>
> Tom Scavo wrote:
> > On 9/25/07, Leif Johansson <leifj@it.su.se> wrote:
> > >
> > > There are at least two ways to model LoA using
> > > SAML - using an AC class or using an attribute.
> >
> > That's correct.  If you decide to use AuthnContext, that
> > means the Kerberos-bound SAML assertion would contain an
> > AuthnStatement.  On the other hand, an Attribute would
> > require an AttributeStatement.
> > (Personally, I think AuthnContext is the way to go for LoA,
> > but the jury's still out on that issue.)
>
> I don't think that it's desirable to prescribe either (1) what
> constitutes an appropriate token for LoA or (2) that a token needs to be
> bound directly to the ticket. The former *should* be a matter for local
> policy, and the latter is not necessary.

With regard to (1), I think you're missing the point, Josh.  How the
LoA is carried in the SAML assertion is a technical detail, not a
matter of policy.  An attribute is more general (because it works in
both SAML V1.1 and V2.0) but SAML V2.0 AuthnContext is preferred (IMO)
since it binds LoA to an AuthnStatement, which is conceptually
correct.

As far as (2) is concerned, you're right, passing additional security
information by value is not strictly necessary.  However, our own
experience integrating SAML into X.509 has clearly shown that pushing
SAML tokens by value is far easier to implement and deploy.  Moreover,
no new wire protocols are required to push X.509-bound SAML tokens.  I
suspect that the Kerberos use case will exhibit similar advantages.

Tom Scavo
NCSA

_______________________________________________
KAML mailing list
KAML@ietf.org
https://www1.ietf.org/mailman/listinfo/kaml