Re: [secdir] Secdir review of draft-ietf-scim-use-cases

["Kepeng Li" <[e-mail]>]

Hi Magnus,

Thanks for the review.

>Section 3.5: Shouldn't there also be a requirement for the secure transfer of
attributes between A and B based on matters such as A trusting authentication
results from B, a means to provide those authentication results securely to B,
etc.? Essentially similar to what was presented in Section 3.3?

OK, I propose to add the following to section 3.5 as requirements:

      Relying party B must be able to authenticate the end user
      Relying party B must be able to securely provide the authentication
results to directory service A
      Directory service A must be able to securely provide end user’s
identity information (e.g., attributes) to relying party B

>Section 3.6: Similar comment as for Section 3.5. There seems to be general
security requirements missing for these two scenarios?

Similarly, I propose to add the following sentences to section 3.6 as
requirements:

      Relying party B must be able to authenticate the end user
      Relying party B must be able to securely provide the authentication
results to directory service A
      Directory service A must be able to securely provide end user’s
changed identity information (e.g., attributes) to relying party B

>Section 4:  Editorial suggestion: "only authenticated entity" -> "only
authenticated entities”.

OK.

Thanks,

Kind Regards
Kepeng


发件人:  Magnus Nyström <[e-mail]>
日期:  Monday, 6 April, 2015 9:51 am
至:  "[e-mail]" <[e-mail]>,
<[e-mail]>
主题:  Secdir review of draft-ietf-scim-use-cases
重发发件人:  <[e-mail]>
重发收件人:  <[e-mail]>
重发日期:  Sun,  5 Apr 2015 18:51:14 -0700 (PDT)


I have reviewed this document as part of the security directorate's ongoing
effort to review all IETF documents being processed by the IESG. These
comments were written primarily for the benefit of the security area
directors. Document editors and WG chairs should treat these comments just
like any other last call comments.

This memo describes the "System for Cross-domain Identity Management
(SCIM)." SCIM is a companion document to the SCIM Schema memo and the SCIM
Protocol memo.

Section 3.5: Shouldn't there also be a requirement for the secure transfer
of attributes between A and B based on matters such as A trusting
authentication results from B, a means to provide those authentication
results securely to B, etc.? Essentially similar to what was presented in
Section 3.3?

Section 3.6: Similar comment as for Section 3.5. There seems to be general
security requirements missing for these two scenarios?

Section 4: I only glanced the Security Consideration sections referenced
here, but they do seem adequate, and given that I don't see that this memo's
Security Consideration section need to contain more information. Editorial
suggestion: "only authenticated entity" -> "only authenticated entities".

-- Magnus