Subject: [kitten] I-D Action: draft-ietf-kitten-sasl-saml-ec-03.txt

From: [email-masked]
Date: Mon, 17 Sep 2012 12:17:44 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Common Authentication Technology Next Generation Working Group of the IETF.

	Title           : SAML Enhanced Client SASL and GSS-API Mechanisms
	Author(s)       : Scott Cantor
                          Simon Josefsson
	Filename        : draft-ietf-kitten-sasl-saml-ec-03.txt
	Pages           : 33
	Date            : 2012-09-17

Abstract:
   Security Assertion Markup Language (SAML) 2.0 is a generalized
   framework for the exchange of security-related information between
   asserting and relying parties.  Simple Authentication and Security
   Layer (SASL) and the Generic Security Service Application Program
   Interface (GSS-API) are application frameworks to facilitate an
   extensible authentication model.  This document specifies a SASL and
   GSS-API mechanism for SAML 2.0 that leverages the capabilities of a
   SAML-aware "enhanced client" to address significant barriers to
   federated authentication in a manner that encourages reuse of
   existing SAML bindings and profiles designed for non-browser
   scenarios.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-kitten-sasl-saml-ec

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-kitten-sasl-saml-ec-03

A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=draft-ietf-kitten-sasl-saml-ec-03

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: "Cantor, Scott" <[email-masked]>
Date: Mon, 17 Sep 2012 19:25:13 +0000

The changes in this revision are in two areas:

I substantially revised the GSS name section to reflect my understand of
issues raised by the OAuth discussion and my own preferences. I settled on
new language around how the default name types for users and services get
used, rules for mapping the authenticated SAML subject to a the user name
type, explicit notes about anonymous cases, and a bit more wording on use
of naming attributes.

I added, at Simon's request of many months ago, a spec for using TLS
exported session keys, including defining a new EXPORTER label that will
have to be registered. I don't really think most GSS implementations could
ever do this, but it doesn't hurt to specify it since it's a heck of a lot
stronger than the alternative I'm left with.

Pending review by implementers and experts, this is feature complete, and
I expect to advance the OASIS drafts this depends on fairly soon now.

-- Scott