Subject: Re: [KAML] latest status

From: "Henry B. Hotz" <[email-masked]>
Date: Tue, 27 Oct 2009 17:35:31 -0700

On Sep 19, 2009, at 11:05 AM, Luke Howard wrote:

>> I think there is interest in solving the authorization problem in a
>> way that scales better than the MS PAC.  There's interest on
>> Microsoft's part as well.  Nobody's come up with a solution that
>> enough people find attractive though.
>
> I'm interested in this, when I get some cycles to work on it.  The GSS
> naming extensions and S4U projects recently committed to MIT will
> help, also I've created a couple of placeholder projects at:
>
> 	http://k5wiki.kerberos.org/wiki/Projects/SAMLInKerberos

Just looked at this.  Added a minor comment, which I think is implied  
by what I've already said on this list.

> 	http://k5wiki.kerberos.org/wiki/Projects/KerberosInSAML

This one's still empty.  I assume the issue is how to relate principal  
names to SAML subject names?

> Last I heard from MS (earlier this week), they are moving towards
> claims-based authorisation but are undecided whether they will support
> claims with "legacy" services such as the file server, and thus
> whether they will support claims in the PAC. (This statement was
> couched in very vague terms, so I might be misinterpreting.)

Reiterated last week (from now).  Don't recall if they were any clearer.

> Their whitepapers on Geneva are worth reading, too:
>
> http://www.microsoft.com/downloads/details.aspx?FamilyID=9ca5c685-3172-4d8f-81cb-1a59bdc9f7e3&displaylang=en
>
> -- Luke

------------------------------------------------------
The opinions expressed in this message are mine,
not those of Caltech, JPL, NASA, or the US Government.
[email-masked], or [email-masked]

---

From: "Scott Cantor" <[email-masked]>
Date: Tue, 27 Oct 2009 20:39:37 -0400

> names to SAML subject names?

There's already a format in SAML for that, but there are other missing
pieces, some of which Josh Howlett and Thomas Hardjono have been proposing
to the OASIS TC, such as representing tickets as a new subject confirmation
method and expressing principal and service names within ds:KeyInfo.

-- Scott