RE: review of draft-wierenga-ietf-sasl-saml-00

["Scott Cantor" <[e-mail]>]

> Scott, I'm happy to work with you to figure out if channel binding
> support is possible in your approach.

I plan to take you up on it. To ease the process of comparing the
approaches, I think it's easiest to produce a simple draft initially, which
highlights some of the issues you mentioned, but leaves things as is for the
same compatibility reasons that Klaas had. The result may be a merging of
the proposals, or not.

Related to this, for example, I'm in favor of supporting a way to tie the
SAML assertion in the response to a key at the TLS layer (holder of key via
client TLS, in other words). That's an addition to the SAML profile I'm
basing this work on, which is why I'm not starting there, to simplify the
compatibility story. I probably will go back to OASIS to get a HoK version
of the ECP profile created, and then I can just reference it.

I'm fairly far along since starting on this last night so I should have
something soon.

-- Scott