Re: [kitten] Proposed GSS extension for explicit credential stores

[Nico Williams <[e-mail]>]

On Tue, Apr 3, 2012 at 7:28 AM, Simon Josefsson <[e-mail]> wrote:
>> URNs will be provided for at least the following:

> I'd really like to see SAML SP metadata included here initially, and
> would be willing to help with writing.  For simplicity, you could have
> multiple URns here, right?  I'm thinking something like this:

Yes, you can have multiple key/value pairs, and the keys are URNs.
And you can have multiple key/value pairs with the same key, so I
think we need to make the abstract type be SEQUENCE OF SEQUENCE { ...
}.

>  urn.ietf.kitten.saml.sp.metadata-file =>
>  "/etc/myapp/sp-metadata.xml"

Sure.

>  urn.ietf.kitten.saml.sp.key-file =>
>  "/etc/myapp/sp-key.pem"

Sure.

>  urn.ietf.kitten.saml.sp.cert-file =>
>  "/etc/myapp/sp-cert.pem"

Sure.

>  urn.ietf.kitten.saml.sp.metadata =>
>  "<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" ..."

Sure.

>  urn.ietf.kitten.saml.sp.cert =>
>  "-----BEGIN CERTIFICATE -----\nMII..."

To repeat what Simo said, we shouldn't put secrets (and I know, a cert
is not a secret, but the private key to go with it is) in
configuration files.  Secrets should go in separate files or HSMs.

> Alternatively, there could be a "struct" approach for SAML SP
> credentials if you wanted to use only one URN for each credential,
> however it gets a bit more ugly:

We want multiple key/value pairs, not just one.

For example, it'd make sense to specify both, a keytab and a ccache,
but we want separate key/value pairs for keytab and ccache.  It also
makes sense to specify multiple keytabs.

>  urn.ietf.kitten.saml.sp =>
>  "metadata_file=/etc/myapp/sp-metadata.xml, key_file=/etc/myapp/sp-key.pem, ..."

Sure.

Nico
--