Subject: RE: [Sip] verifying identity of sender

From: "Peterson, Jon" <[email-masked]>
Date: Fri, 22 Oct 2004 17:46:59 -0400

> -----Original Message-----
> From: Mauricio Arango [mailto:[email-masked]]
> 
> For clarification, is the comment of "SAML heavy" because of the
> pre-associations only?

Pre-association and federation, agreement on various SAML attribute and so
on is one aspect of it. I also think the support for XML, web services, and
so on cannot be universally assumed in a SIP environment - a widespread
mandate for SAML support would entail a lot of additional development,
beyond SIP's current implementation challenge.

Our emphasis in identity design has been on providing a very light solution,
something that doesn't require us to diverge significantly from the
operational models and implementation already described in the core
standard. We also want to provide something for identity that is universal,
and useful in essentially all contexts that SIP is used. I don't think we
can position SAML to play that part in SIP's architecture, though it can
certainly provide valuable supplemental security assertions for some
deployments.

Jon Peterson
NeuStar, Inc.

> 
> Sounds like a good initial approach.
> 
> Mauricio Arango
> 
> 

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Mauricio Arango <[email-masked]>
Date: Tue, 26 Oct 2004 17:31:27 -0400

Use of SAML in SIP doesn't require federation, nor
does it require Web Services, and pre-associations are minimal.
Additional explanations as follows:

- A Web Services stack isn't required when SIP is used to
transport  SAML assertions (or references to it). SAML
comprises assertions and protocols. Use of SAML
for the scenarios we are discusing would not involve use of
SAML protocols.

- Use of SAML to verify the 'From' identity in SIP
doesn't require federation. Federation is the linking of
one identity in one administrative domain with another
identity in another administrative domain.  Verification
of the 'From' identity doesn't demand its linking with
another identity at the destination of the SIP request.
Federation isn't a mandatory step for any use of SAML
assertions.

- Pre-associations for the scenarios under consideration
are minimal. A SAML assertion would refer to
its governing schema in the usual XML/namespaces fashion,
which would either require pre-configuration of the schema
or on-the-fly loading. Another aspect that requires
pre-association is agreement of the method to handle
a signed assertion received from the authentication proxy.
This part would have to be handled independently of whether
SAML is used or not.

- With respect to support for XML.
XML parsers could be an issue in limited-capability
user devices, though there is a increasing number
of XML parsers for small devices. Nevertheless,
XML processing for SIP identity would only be
required by the authentication proxy at the
requesting side and by the receiving side domain
proxy, which are usually servers. Also, there is
precendent of using XML in SIP as in event list
notifications.

Regards,

Mauricio Arango