Re: [plasma] [abfab] FW: New Non-WG Mailing List: plasma -- The PoLicy Augmented S/Mime (plasma) bof discussion list

I would like to add a few additional things to this as well.

We are currently looking at a proposal that is based on WS-Trust (SOAP based
token system) for communications between the mail client and the mail policy
server and, while using SAML, are placing how the SAML assertion(s) are
obtained is out of scope.   However I think that a good alternative to this
might be to look at using the ABFAB architecture.  We would then have the
mail client talking some protocol to the mail policy server which would be
using the ABFAB architecture to talk AAA to the correct identity service.
In some cases the identity service and the mail policy server would be
co-located, but this would be invisible to the mail client.

Doing this would simplify things as the correct SAML assertion would be
obtained by the policy server and it can ask for the type of details that it
wants without the client having to try and guess what is required.  On the
other hand it might complicate issues as we are looking at the ability for
the mail policy service to issue "short-term" tokens to the mail client
after having gone through a full policy check that stands in for abilities.
Thus not all of the ABFAB EAP would be used all of the time.

If you have an interest in talking about this, it would be better to join
the PLASMA mailing list and respond there.

Jim

> -----Original Message-----
> From: abfab-bounces@ietf.org [mailto:abfab-bounces@ietf.org] On Behalf Of
> Trevor Freeman
> Sent: Thursday, February 03, 2011 2:56 PM
> To: abfab@ietf.org
> Cc: jimsch@nwlink.com; Trevor Freeman
> Subject: [abfab] FW: New Non-WG Mailing List: plasma -- The PoLicy
> Augmented S/Mime (plasma) bof discussion list
> 
> PLASMA - Policy Augmented S/Mime
> 
> Description: Current S/MIME mechanisms provide cryptographic access to the
> message based on the identity of the recipient at the time of
transmission. Any
> additional access control enforcement depends on the configuration of the
> recipients email client. Several Internet-Drafts have been submitted that
> establish a more robust access control mechanism where cryptographic
access
> to the message is only granted after the access check.
> 
> This proposed working group would develop a framework for enforcing a more
> robust access control mechanism, based on existing CMS, S/MIME and SAML-
> based policy enforcement standards. The working group will also develop
any
> necessary extensions to these base protocols specific to this problem
space.
> 
> Given the mutual interest in SAML - this work may be of interest to some
of
> you.
> 
> -----Original Message-----
> From: IETF Secretariat [mailto:ietf-secretariat@ietf.org]
> Sent: Thursday, February 03, 2011 11:54 AM
> To: IETF Announcement list
> Cc: plasma@ietf.org; jimsch@nwlink.com; Trevor Freeman
> Subject: New Non-WG Mailing List: plasma -- The PoLicy Augmented S/Mime
> (plasma) bof discussion list
> 
> A new IETF non-working group email list has been created.
> 
> List address: plasma@ietf.org
> Archive: http://www.ietf.org/mail-archive/web/plasma/
> To subscribe: https://www.ietf.org/mailman/listinfo/plasma
> 
> Description:
> Current S/MIME mechanisms provide cryptographic access to the message
> based on the identity of the recipient at the time of transmission. Any
> additional access control enforcement depends on the configuration of the
> recipients email client. Several Internet-Drafts have been submitted that
> establish a more robust access control mechanism where cryptographic
access
> to the message is only granted after the access check. This list is
devoted to the
> discussion of these drafts and any related future submissions.
> 
> For additional information, please contact the list administrators.
> _______________________________________________
> abfab mailing list
> abfab@ietf.org
> https://www.ietf.org/mailman/listinfo/abfab