Subject: GGF evidently needs stackable pseudo-mechs

From: Nicolas Williams <[email-masked]>
Date: Tue, 19 Jul 2005 13:06:04 -0500

There's a Globus OGSA document describing what I recognize to be a sort
of stackable pseudo-mechanism, but I can't find a URL for it.  As soon
as I find it I'll post it.

Nico
-- 
_______________________________________________
Kitten mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/kitten

---

From: Nicolas Williams <[email-masked]>
Date: Tue, 19 Jul 2005 13:09:29 -0500

> as I find it I'll post it.

Bah.  It looks like the GGF has abandoned this -- don't be misled by the
last update date -- that was a macro.

---

From: "Von Welch" <[email-masked]>
Date: Tue, 19 Jul 2005 13:19:22 -0500

I'm not sure what you mean by "abandoned". We're not moving the
document forward in GGF because we deferred to kitten as the place to
do so, but the document does capture what we saw as our needs and we
have implemented and are using it.

I'm not sure from the context of your note what part of it you were
specifically interested in. I'm happy to field questions or elaborate.

Von

---

From: Jeffrey Altman <[email-masked]>
Date: Thu, 21 Jul 2005 10:10:49 -0400

I believe that Nico is interested in the binding between GSS
authentication and SAML data.

Jeffrey Altman

---

From: Nicolas Williams <[email-masked]>
Date: Thu, 21 Jul 2005 10:33:53 -0500

> specifically interested in. I'm happy to field questions or elaborate.

If you've deployed then it'd be a good idea to update this doc.

I do have a few questions about this mechanism though, such as what its
OID(s) is(are).

Nico
--

---

From: Nicolas Williams <[email-masked]>
Date: Thu, 21 Jul 2005 11:25:07 -0500

> authentication and SAML data.

Indeed.

Nico
--

---

From: "Von Welch" <[email-masked]>
Date: Thu, 21 Jul 2005 12:47:58 -0500

Still not entirely sure what you're looking for.

We don't do any SAML-based authentication, we do PKI (with a GSS
interface) for authentication and use SAML assertions to convey
attributes or authorization assertions.

We use a hack of putting SAML assertions into X509 extensions as a
way to convey those assertions through TLS and other protocols and
then use GSS extensions described in the GGF document to pull those
assertions out.

Von

---

From: Jeffrey Altman <[email-masked]>
Date: Thu, 21 Jul 2005 14:05:57 -0400

SAML is not used for authentication.   As you point out it is used
for authorization assertions.   I think the most relevant part of
the document for GSS will be the interface used to pull out
the assertions.   Kitten should work to define a generic interface
that would work equally well with assertions stored as X.509 extensions
or authz-data stored in a Kerberos ticket.

Jeffrey Altman

---

From: Nicolas Williams <[email-masked]>
Date: Fri, 22 Jul 2005 09:40:55 -0500

> attributes or authorization assertions.

Right, and that's what I'm interested in.

> then use GSS extensions described in the GGF document to pull those

Ah.

---

From: Nicolas Williams <[email-masked]>
Date: Fri, 22 Jul 2005 09:41:40 -0500

> or authz-data stored in a Kerberos ticket.

And, of course, KITTEN *is* working such extensions.

---

From: "Von Welch" <[email-masked]>
Date: Fri, 22 Jul 2005 17:31:53 -0500

Ok, here's the final version of the document to make sure we have a
consistent view of section numbers:

http://www.ggf.org/documents/GFD.24.pdf

The relevant extensions are using are described in section 2.3.

In our implementation we use the first call (in 2.3.1) to pull X509
extensions from the certificate and then push those into a GAA
library.

Conceptually one could define an OID meaning give me any SAML
attribute assertions associated with the client in the context.

I also recall a conversation a while back where someone (you or
Jeffrey I think) argued this would be better done as a inquiry
mechanism based on the gss_name, which I agree with.

Von

---

From: Nicolas Williams <[email-masked]>
Date: Fri, 22 Jul 2005 17:54:03 -0500

> mechanism based on the gss_name, which I agree with.

We have two KITTEN WG Internet-Drafts on this:

http://www.ietf.org/internet-drafts/draft-ietf-kitten-gss-naming-02.txt
http://www.ietf.org/internet-drafts/draft-ietf-kitten-gssapi-naming-exts-00.txt

I don't recall anymore who suggested it -- Jeff, Sam or I, but it
doesn't matter; what matters is that KITTEN is chartered to do this
work, so the GGF will want to help ensure we're addressing its needs.

So please review them! :)

Thanks,

Nico
--