Subject: Re: [kitten] I-D Action: draft-ietf-kitten-gssapi-naming-exts-11.txt

From: Leif Johansson <[email-masked]>
Date: Sun, 13 Nov 2011 03:12:18 +0100

On 10/27/2011 04:38 PM, Cantor, Scott wrote:
> On 10/27/11 3:10 AM, "Leif Johansson" <[email-masked]> wrote:
>> 
>> Why not simply say
>> 
>> "This is analogous to the SAML 
>> urn:oasis:names:tc:SAML:2.0:nameid-format:persistent NameID
>> format and has comparable security and privacy properties and
>> implications."
> 
> Obviously that's the "fix", but I think that's confusing in
> context because that format is about much more than uniqueness, and
> I think all you're trying to say in that sentence is that the
> naming attributes might themselves provide a unique (possibly
> omnidirectional) identifier. In other words, any SAML attribute of
> NameID might end up in there and be used for that purpose, not just
> (or even predominantly) that one.
> 
>> I give you that you could (and might want to) include much more
>> detail to make this a really understandable example wo prior SAML
>> knowledge but nevertheless I believe it would be good to have
>> something on this important topic.
> 
> I think I'd avoid the SAML reference, then, and just state
> something more general. Or I'd use more than one SAML example,
> because you don't just mean a directed ID here.

Could you give me a sample of text to use as a second example?

	Cheers Leif

---

From: "Cantor, Scott" <[email-masked]>
Date: Sun, 13 Nov 2011 20:22:10 +0000

>Could you give me a sample of text to use as a second example?

"When the underlying security mechanism does not provide a permanent
unique identity (e.g., anonymous kerberos), GSS-API naming extensions may
be used to provide a permanent unique identity attribute. This may be a
globally unique identifier, a value unique within the namespace of the
attribute issuer, or a "directed" identifier that is unique per peer
acceptor identity.

SAML, to use one example technology, offers a number of built-in
constructs for this purpose, such as a <NameID> with a Format of
"urn:oasis:names:tc:SAML:2.0:nameid-format:persistent". SAML deployments
also typically make use of domain-specific attribute types that can serve
as identifiers."

I think the second paragraph is entirely optional, but if you want an
example, that's what I'd suggest.

-- Scott

---

From: Leif Johansson <[email-masked]>
Date: Mon, 14 Nov 2011 02:29:55 +0100

On 11/13/2011 09:22 PM, Cantor, Scott wrote:
> "When the underlying security mechanism does not provide a
> permanent unique identity (e.g., anonymous kerberos), GSS-API
> naming extensions may be used to provide a permanent unique
> identity attribute. This may be a globally unique identifier, a
> value unique within the namespace of the attribute issuer, or a
> "directed" identifier that is unique per peer acceptor identity.
> 
> "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent". SAML
> deployments also typically make use of domain-specific attribute
> types that can serve as identifiers."
> 
> I think the second paragraph is entirely optional, but if you want
> an example, that's what I'd suggest.
> 
> -- Scott
> 

I assume you meant for this to replace the paragraph in question -
this sounds good to me.

	Cheers Leif