Re: attributes in AC

[Stephen Farrell <[e-mail]>]

Slightly late response, but here it is...

Syntactically, the access identity attribute can't have the authInfo 
field present. This basically means that you should use the access
identity field if the relying party is willing to believe a straight
assertion from the AA about the holder's identity. In theory that 
should be enough, but it turns out that there are many applications
which still require a username & password to identify/authenticate
a user, so the service auth info attribute allows support for such
applications.

As an example of where this might apply, say you inegrate the AC
relying party code into a web server, with a set of web applications
being called from the web server. Now some of those applications
will simply accept a user identity passed from the web server, using
say the ssl client or holder field for identity, others will have their 
own concept of usernames (so you can use the access identity for those),
but still others will have their own username/password handling (so 
you can use service auth info and not bother the user with entry of
additional passwords).

Hope this makes it clearer,
Stephen.

Hideyuki Odahara wrote:
> 
> Please teach me the difference of the use of
> "Service Authentication Infomation" and "Access Identity"
> in Attribute Certificate, and how to use the "Access Identity"
> attribute if you have any concrete example.
> 
> It is described that "this is a different use to that intended
> for the svceAuthInfo attribute discribed in 4.4.1 above." at the
> page 19 in the internet-draft(draft-ietf-pkix-ac509prof).
> But there is no example what situation does it suit.
> 
> thanks
> 
> ----------
>   Hideyuki Odahara $B!'(B [e-mail]

-- 
____________________________________________________________
Stephen Farrell         				   
Baltimore Technologies,   tel: (direct line) [phone]
39 Parkgate Street,                     fax: [phone]
Dublin 8.                mailto:[e-mail]
Ireland                             http://www.baltimore.com