Subject: [TLS] Authorization extension test server available

From: Simon Josefsson <[email-masked]>
Date: Thu, 22 Feb 2007 10:28:17 +0100

Hi all!  GnuTLS now supports the TLS authorization extension, and I'm
wondering if anyone is interested in interop testing of this feature?

Our public test server supports RFC 4680 and
draft-housley-tls-authz-extns-07 in case someone wants to point their
clients towards a server:

http://www.gnu.org/software/gnutls/server.html

It may be too late to change the specifications, but my comments after
implementing this were:

- The size of authorization data, i.e., X.509 attribute certs and SAML
  assertions, are limited to 64kb.  Is it certain that we won't need
  more?

- There is no discussion on authorization failures.  Should the
  handshake be aborted?  This is complicated by the fact that the
  authorization data is sent _before_ authentication data.  Typically
  you wait until authentication is complete before processing
  authorization data.

/Simon

_______________________________________________
TLS mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tls

---

From: Russ Housley <[email-masked]>
Date: Thu, 22 Feb 2007 11:02:09 -0500

>http://www.gnu.org/software/gnutls/server.html

Very cool.

>   assertions, are limited to 64kb.  Is it certain that we won't need

I have little experience with SAML, but 64K is a lot of space for 
attribute certificates.

>   you wait until authentication is complete before processing

We discussed this while developing the specification.  The current 
document is the cleanest way to use the extension mechanism that we 
could devise.  And, no one offered a better alternative during the 
review process.  Of course, implementation and deployment experience 
may show us a better way.

If the authorization requirements are not satisfied, then the TLS 
session should be shutdown.  I would expect the access_denied fatal 
alert to be used.

Russ

---

From: Ari Medvinsky <[email-masked]>
Date: Thu, 22 Feb 2007 08:50:27 -0800

It is a good idea to increase the size for SAML to be more then 64k -
note that just the XML Dig Sig on a SAML assertion is around 16K; then
within the SAML assertion you can have any number of attribute
statements, etc.

Ari Medvinsky
Sr. Program Manager
Windows Security

-----Original Message-----
From: Russ Housley [mailto:[email-masked]] 
Sent: Thursday, February 22, 2007 8:02 AM
To: Simon Josefsson; [email-masked]
Subject: Re: [TLS] Authorization extension test server available

Very cool.

Russ