Subject: [dix] dmd1 & SAML

From: John Merrells <[email-masked]>
Date: Tue, 14 Mar 2006 09:42:09 -0800

I've been playing with describing a digitally signed third-party  
claim in SAML
and moving that over dmd1. I've mapped what I think should be in a claim
into the SAMLv2 schema... but I'm not sure it's exactly right. Also,  
I believe
it's out of scope for DIX, but I want to ensure that this  
functionality can be
layered on top. How about an off-list conversation to discuss this?

John

_______________________________________________
dix mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dix

---

From: Pete Rowley <[email-masked]>
Date: Tue, 14 Mar 2006 10:53:40 -0800

> layered on top. How about an off-list conversation to discuss this?

Is it really out of scope?  DIX would need to be capable of carrying 
such traffic so I think it is useful to demonstrate methods of doing so, 
if for nothing else than to be sure that it can be done.

-- 
Pete

---

From: John Merrells <[email-masked]>
Date: Tue, 14 Mar 2006 11:10:54 -0800

On 14-Mar-06, at 10:53 AM, Pete Rowley wrote:

>> into the SAMLv2 schema... but I'm not sure it's exactly right.  
>> Also,  I believe
> Is it really out of scope?  DIX would need to be capable of  
> carrying such traffic so I think it is useful to demonstrate  
> methods of doing so, if for nothing else than to be sure that it  
> can be done.

We'll that's my intent, I'm just not sure the details of the  
conversation should be
here. Here I'd like to focus on the moving things about aspects  
without worrying
too much about what the things are.

John

---

From: Jeff Hodges <[email-masked]>
Date: Tue, 14 Mar 2006 17:12:39 -0800

John Merrells wrote:
 >
 > Here I'd like to focus on the moving things about aspects without
 > worrying too much about what the things are.

Well, that -- not worrying about "what the things are" -- doesn't work when one 
is designing a security protocol (which is what an identity protocol is). What 
is in the objects being exchanged, and the semantics attached to it/them, are 
of utmost importance to the meaning of the protocol.

JeffH

---

From: John Merrells <[email-masked]>
Date: Tue, 14 Mar 2006 21:10:00 -0800

On 14-Mar-06, at 5:12 PM, Jeff Hodges wrote:

> Well, that -- not worrying about "what the things are" -- doesn't  
> work when one is designing a security protocol (which is what an  
> identity protocol is). What is in the objects being exchanged, and  
> the semantics attached to it/them, are of utmost importance to the  
> meaning of the protocol.

Not sure where you're coming from there. By analogy LDAP moves  
attributes around and we don't concern ourselves in the protocol  
specification with what they actually are. I think DIX can achieve  
the same positive effect.... it moves attributes from the user's  
identity agent to some consuming website. I'm thinking that that  
attribute value could be a SAML token, in this case an attribute  
assertion.

John