Re: [ogpx] Seed capability behavior

[Hogmanay Milestone <[e-mail]>]

yes. you don't want the proxy to retain the right (either by error or by malice) to request subordinate service caps from the agent domain or the sensitive service on the intranet.

if you assume that the client's enterprise has a trust relationship with the agent domain, the question of "who do you get the seed cap from" can go either way.

in one case, the client may authenticate to an "agent domain" managed by their enterprise using the password from their enterprise SSO solution. the "enterprise agent domain" may then contact a public agent domain through a different channel and retrieve a seed cap from the public agent domain. it (the enterprise agent domain) could then pass this seed cap on to the client.

or it could go the other way...

maybe you want the enterprise to be able to "bless" a user account defined in a public agent domain (like second life.) in this case, the client would authenticate to the public agent domain first. the public agent domain would then use some other technique to request a service caps from the enterprise agent domain, and would then pass them along to the client.

this would be a good use case if the enterprise wanted to grant privilege to existing accounts on a public agent domain instead of assuming the cost of provisioning a user account in their own domain.



----- Original Message ----
From: Infinity Linden (Meadhbh Hamrick) <[e-mail]>
To: Hogmanay Milestone <[e-mail]>
Cc: Arrogant Cyberstar <[e-mail]>; David W Levine <[e-mail]>; [e-mail]; "[e-mail]" <[e-mail]>
Sent: Wed, January 20, 2010 5:16:55 PM
Subject: Re: [ogpx] Seed capability behavior

On Wed, Jan 20, 2010 at 17:03, Hogmanay Milestone
<[e-mail]> wrote:
>>
>>but why would you need a proxy anyway?
>
>
> because the services requested by the proxy may be on the inside of a firewall while the client is on the outside. if the proxy was in the DMZ, you could use traditional network security tools to ensure that service requests only come from a proxy that you trust.
>

so if i understand you correctly, you want the client out there on the
internet to authenticate to an agent domain, get a seed capability
from the agent domain and then pass that seed capability to a proxy in
the DMZ of some organization (say, like the client's employer.)

the proxy would then use that seed cap to request service caps from...
someone? the agent domain? or a server in the client's employer's
intranet (that the proxy can access because it's in the DMZ?)

it's unclear where you're requesting the service caps from.

but i think i understand why you want the seed cap to be a one-shot.
if it wasn't a one-shot, the proxy _could_ retain the ability to
request service caps on the client's behalf.