draft-ietf-pkix-ac509prof -> RFC?

[Hideyuki Odahara <[e-mail]>]

Mr. Stephen Farrell

Thank you for your reply the example of use of an attribute the other
day.
I would like you to teach about RFC-izing of draft-ietf-pkix-ac509prof
today, and mail was given. While it is said that ac509prof has near
RFC-izing, it is not RFC-ized easily. Now, would you the argument is
progressing how much and teach [ when to RFC-be due to beized and ] this
draft?
Although humiliated a busy place, I ask of you well.

thanks


> 
> Slightly late response, but here it is...
> 
> Syntactically, the access identity attribute can't have the authInfo 
> field present. This basically means that you should use the access
> identity field if the relying party is willing to believe a straight
> assertion from the AA about the holder's identity. In theory that 
> should be enough, but it turns out that there are many applications
> which still require a username & password to identify/authenticate
> a user, so the service auth info attribute allows support for such
> applications.
> 
> As an example of where this might apply, say you inegrate the AC
> relying party code into a web server, with a set of web applications
> being called from the web server. Now some of those applications
> will simply accept a user identity passed from the web server, using
> say the ssl client or holder field for identity, others will have their 
> own concept of usernames (so you can use the access identity for those),
> but still others will have their own username/password handling (so 
> you can use service auth info and not bother the user with entry of
> additional passwords).
> 
> Hope this makes it clearer,
> Stephen.
> 
> Hideyuki Odahara wrote:
> > 
> > Please teach me the difference of the use of
> > "Service Authentication Infomation" and "Access Identity"
> > in Attribute Certificate, and how to use the "Access Identity"
> > attribute if you have any concrete example.
> > 
> > It is described that "this is a different use to that intended
> > for the svceAuthInfo attribute discribed in 4.4.1 above." at the
> > page 19 in the internet-draft(draft-ietf-pkix-ac509prof).
> > But there is no example what situation does it suit.
> > 
> > thanks

----------
  Hideyuki Odahara ： [e-mail]