Re: [sacm] Authentication and Authorization for Content Repository

initial thoughts are to look at the Resource Oriented Lightweight Indicator Exchange draft:
http://tools.ietf.org/html/draft-field-mile-rolie-00 
Rolie is on the MILE agenda we should review.

We may also want to look at the what the kitten working group is doing in this area 
 https://datatracker.ietf.org/doc/charter-ietf-kitten/

-ln

On Nov 6, 2012, at 9:05 AM, David Solin wrote:

> Hi Chandra,
> 
> Authentication and authorization should be handled exclusively at the HTTP/(S) layer.  This would allow for Basic, Digest, NTLM, Kerberos, SSL certs, SAML, etc. -- whatever it is that the repository specifies.  (Incidentally, the standard practice for a web server to use client certificates for authorization purposes is to implement a certificate mapping).
> 
> So, I see no reason why use of SAML should be required by the specification; it should be completely agnostic in this regard.
> 
> Regards,
> --David Solin
> 
> On 11/6/2012 7:45 AM, Chandrashekhar B wrote:
>> There were some discussion on this topic earlier and it was somewhat concluded that authorization and access control should not be part of the standardization effort, as it brings-in complexity. As an effort to make SCAP Repo’s web service authentication and authorization seamless and support subscription services, we took up an exercise to think through various options.
>>  
>> We currently have User ID and Password based mechanism, which will not work in an automated environment.
>> SSL mutual certificate based authentication is another option but, brings its own complexity and there are no authorization statements in a standard certificate.
>>  
>> After looking at few other non-standard option, we thought SAML authorization assertion is the way to go and it binds well to the enterprise SSO implementations. So, keeping the IDP and token issuance out of scope from the standardization point of view, we can ask the repository <-> repository or client <- > repository interactions come with SAML authorization token. SAML token can be sent part of the HTTP Authorization Header (compressed), which fits well with the RESTful web service model.
>>  
>> Any thoughts on this?
>>  
>> Thanks,
>> Chandra.
>> 
>> 
>> _______________________________________________
>> sacm mailing list
>> sacm@ietf.org
>> https://www.ietf.org/mailman/listinfo/sacm
> 
> 
> -- 
> jOVAL.org: SCAP Simplified.
> Learn More | Features | Download
> 
> _______________________________________________
> sacm mailing list
> sacm@ietf.org
> https://www.ietf.org/mailman/listinfo/sacm