Re: [pkix] Comments on draft-santesson-auth-context-extension-04

[Stefan Santesson <[e-mail]>]

Denis,

If you don't understand how this information can be useful, that probably
is because you don't have a problem that needs this information.

If you don't have a problem that needs this information, why does any of
this bother you?

The matching rules are not necessary because matching of SAML attributes
is defined by SAML.


Anyway. Answering below;

On 3/11/13 10:41 AM, "Denis Pinkas" <[e-mail]> wrote:

>Martin,
>
>The problem is that we currently only have a static description for a
>mapping but no indication on how
>a RP shall use the content of the extension, in particular when it is
>critical.

The information is there. You may use it any way you like. There are many
use-cases describing situations where this information is useful.
Criticality only means that you need to recognise the extension in order
to accept the cert, not that you have to use it in any particular way.

>
>I have also difficulties to understand why this mapping information
>needs to be in the certificate since it will be in the audit trail of
>the CA anyway.


That is probably because you don't have a problem that requires this
information in the cert. The CA audit trail is not available to the RP at
time of cert validation.

>
>What is important is how the RP shall use that information and my
>understanding is still the following:
>making sure the the certificate belongs to a person that has used a SAML
>token.

The RP can use several strategies depending on the amount and type of
information present in the extension.
It either gives you the information you need as RP (filling an information
gap) or it doesn't.
If it does it makes it possible for you to accept the cert.


>
>So it is much straightforward to include in the certificate information
>about the SAML token itself rather than
>information on a mapping with the content of the DN which anyway is of
>no value for a RP because it cannot be verified.

If that is what you need, then feel free to define such extension.
I need a certificate that carries a normal cert name. I just need extra
information to understand what that name is.

>
>If a document is targeted to informational, it is because it may be
>useful outside the community which has an original interest in it.


Not necessarily. But if someone has a problem that is addressed here
(which you obviously have not), then I would not mind make it useful
outside of our project.

/Stefan

>
>Denis
>
>> Denis,
>>
>> While I have no personal interest or use in this proposal myself,
>> I'm somewhat confused by your message.
>>
>> Denis Pinkas wrote:
>>> Allowing to have SAML attributes in a PKC would be a very good thing.
>>> However, the relying party DOES NOT care
>>> how these SAML attributes have been translated into a subject DN. It is
>>> the responsibility of the CA.
>> Stefan said that he _has_ RPs who care.  Where is your problem with
>>this?
>>
>>
>>> Thus, if the scope only remains to know how the correspondence was made
>>> between  the SAML attributes and
>>> the subject DN, I don't believe that this document will be useful for
>>> the Internet community and thus I am still unconvinced
>>> that this document should progress as an Internet Draft.
>> "progress as Internet Draft"?
>> (I have not the slightest idea what that is.)
>>
>>  From the document header, Stefan seems to be looking for an Individual
>> Submission with the intended document status "Informational".
>>
>> Were you thinking of a Standards track document?
>> Or were you thinking about a WG work item (Last thing I heard was that
>> PKIX is scheduled to shut down (as IETF WG) and not accepting any
>>further
>> work items).  Only the latter two would need any kind of "approval".
>>
>>
>> Stefan's primary interest seems to be sharing information about what he
>> does (or intends to do) with the IETF community.  And Stefan seems to
>> solicit and accept feedback and suggestions from the PKIX community
>> to make this work more useful to others.
>>
>>
>>> If the scope is changed to allow to include SAML attributes as another
>>> name form in a PKC, then this is
>>> an important issue which deserves an Internet Draft.
>> Stefan indicated that he needs this extension to convey information
>> that does not qualify as SAN/otherName, so this feedback seems to be
>> missing the point.
>>
>> If you have a need for this, you might have to create your own
>>proposal/I-D
>> to fit this purpose.
>>
>>
>> -Martin
>
>
>_______________________________________________
>pkix mailing list
>[e-mail]
>https://www.ietf.org/mailman/listinfo/pkix