Subject: [OAUTH-WG] Fwd: New Version Notification for draft-campbell-oauth-saml-01

From: Brian Campbell <[email-masked]>
Date: Mon, 13 Dec 2010 15:53:23 -0700

Draft -01 of "SAML 2.0 Bearer Assertion Grant Type Profile for OAuth
2.0" is now available at
http://www.ietf.org/id/draft-campbell-oauth-saml-01.txt

The changes (change log pasted blow) are mostly responding to feedback
from this WG and from the SSTC as well as bringing it up to date with
draft-ietf-oauth-v2-11.  The one change that was previously discussed
on this list that I didn't incorporate into the draft, and I'm still
somewhat on the fence about, is allowing for more than one assertion.

Comments and questions are welcome as always.

Thanks,
Brian

   -01

   o  Updated to reference draft-ietf-oauth-v2-11 and reflect changes
      from -10 to -11.

   o  Updated examples.

   o  Relaxed processing rules to allow for more than one
      SubjectConfirmation element.

   o  Removed the 'MUST NOT contain a NotBefore attribute' on
      SubjectConfirmationData.

   o  Relaxed wording that ties the subject of the Assertion to the
      resource owner.

   o  Added some wording about identifying the client when the subject
      hasn't directly authenticated including an informative reference
      to SAML V2.0 Condition for Delegation Restriction.

   o  Added a few examples to the language about verifying that the
      Assertion is valid in all other respects.

   o  Added some wording to the introduction about the similarities to
      Web SSO in the format and processing rules

   o  Changed the grant_type (was assertion_type) URI from
      http://oauth.net/assertion_type/saml/2.0/bearer to
      http://oauth.net/grant_type/assertion/saml/2.0/bearer

   o  Changed title to include "Grant Type" in it.

   o  Editorial updates based on feedback from the WG and others
      (including capitalization of Assertion when referring to SAML).

---------- Forwarded message ----------
From: IETF I-D Submission Tool <[email-masked]>
Date: Mon, Dec 13, 2010 at 3:10 PM
Subject: New Version Notification for draft-campbell-oauth-saml-01

A new version of I-D, draft-campbell-oauth-saml-01.txt has been
successfully submitted by Brian Campbell and posted to the IETF
repository.

Filename:        draft-campbell-oauth-saml
Revision:        01
Title:           SAML 2.0 Bearer Assertion Grant Type Profile for OAuth 2.0
Creation_date:   2010-12-13
WG ID:           Independent Submission
Number_of_pages: 11

Abstract:
This specification defines the use of a SAML 2.0 bearer Assertion as
means for requesting an OAuth 2.0 access token.

The IETF Secretariat.

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Mon, 13 Dec 2010 20:19:25 -0700

I think the 'assertion' parameter should be moved into this draft and defined there. This will also facilitate its proper definition and status (required, singular, etc.).

EHL

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf
> Of Brian Campbell
> Sent: Monday, December 13, 2010 2:53 PM
> To: oauth
> Subject: [OAUTH-WG] Fwd: New Version Notification for draft-campbell-
> oauth-saml-01
> 
> Draft -01 of "SAML 2.0 Bearer Assertion Grant Type Profile for OAuth 2.0" is
> now available at http://www.ietf.org/id/draft-campbell-oauth-saml-01.txt
> 
> from this WG and from the SSTC as well as bringing it up to date with draft-
> ietf-oauth-v2-11.  The one change that was previously discussed on this list
> that I didn't incorporate into the draft, and I'm still somewhat on the fence
> about, is allowing for more than one assertion.
> 
> A new version of I-D, draft-campbell-oauth-saml-01.txt has been successfully
> submitted by Brian Campbell and posted to the IETF repository.
> 
> This specification defines the use of a SAML 2.0 bearer Assertion as means
> for requesting an OAuth 2.0 access token.
> 
> 
> 
> The IETF Secretariat.
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: Torsten Lodderstedt <[email-masked]>
Date: Tue, 14 Dec 2010 17:05:50 +0100

+1

---

From: Brian Campbell <[email-masked]>
Date: Tue, 14 Dec 2010 09:10:47 -0700

Future revisions of this SAML draft will build off whatever
assertion/extension mechanism is provided by the core framework spec.
However, some compelling reasons were previously given for keeping the
'assertion' (one thread on the topic:
http://www.ietf.org/mail-archive/web/oauth/current/msg04401.html)
parameter in core.  Has the thinking on that changed?

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Tue, 14 Dec 2010 09:23:33 -0700

Torsten made a good argument that now that we combined assertions and extensions into a single mechanism, it does not make sense to make the 'assertion' parameter required, and that some extensions will be confusing with such a parameter name. In addition, the recent document split demoted this specification from 'core' to 'framework' which is more friendly to extensions and companion specifications.

I would suggest we drop the assertion parameter from the spec, but add a directly reference to the SAML assertion specification and give an example showing the parameter. This will remove the normative language (which really doesn't belong there - something I've long maintained), but will keep the SAML assertion option on equal ground (directly demonstrated in the spec). After all, you can't implement assertions just by reading the framework spec, you still need the SAML work.

This will require moving the SAML into a WG item (not a must but best) which I am supportive of and would like to see happen quickly (in a few days).

Thoughts?

EHL

> From: Brian Campbell [mailto:[email-masked]]
> Sent: Tuesday, December 14, 2010 8:11 AM
> To: Torsten Lodderstedt
> Cc: Eran Hammer-Lahav; oauth
> Subject: Re: [OAUTH-WG] Fwd: New Version Notification for draft-campbell-
> oauth-saml-01
> 
> >> I think the 'assertion' parameter should be moved into this draft and
> defined there. This will also facilitate its proper definition and status
> (required, singular, etc.).
> >>
> >> EHL
> >>

---

From: Brian Campbell <[email-masked]>
Date: Tue, 14 Dec 2010 11:18:24 -0700

I don't have any objection to it and think it's probably cleaner.

Previously I'd informally asked that the SAML profile be considered a
WG item and I don't think there was any objection. What needs to be
done to make that happen?

If you/we take this approach, what else will you need from me?

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Tue, 14 Dec 2010 18:26:07 -0700

Prepare a new draft if needed and submit it with draft-ietf-oauth- prefix. One of the chairs will need to approve it and it will be published. I think we have wide consensus for this and this was already proposed a long time ago with no objections.

EHL

> Sent: Tuesday, December 14, 2010 10:18 AM
> To: Eran Hammer-Lahav
> Cc: Torsten Lodderstedt; oauth
> Previously I'd informally asked that the SAML profile be considered a WG
> item and I don't think there was any objection. What needs to be done to
> make that happen?
> 
> > Torsten made a good argument that now that we combined assertions and
> extensions into a single mechanism, it does not make sense to make the
> 'assertion' parameter required, and that some extensions will be confusing
> with such a parameter name. In addition, the recent document split
> demoted this specification from 'core' to 'framework' which is more friendly
> to extensions and companion specifications.
> >
> > I would suggest we drop the assertion parameter from the spec, but add a
> directly reference to the SAML assertion specification and give an example
> showing the parameter. This will remove the normative language (which
> really doesn't belong there - something I've long maintained), but will keep
> the SAML assertion option on equal ground (directly demonstrated in the
> spec). After all, you can't implement assertions just by reading the
> framework spec, you still need the SAML work.
> >
> > This will require moving the SAML into a WG item (not a must but best)
> which I am supportive of and would like to see happen quickly (in a few
> days).
> >
> > Thoughts?
> >
> > EHL
> >
> >> However, some compelling reasons were previously given for keeping
> >> the 'assertion' (one thread on the topic:
> >> defined there. This will also facilitate its proper definition and
> >> status (required, singular, etc.).
> >> >>
> >> >> EHL
> >> >>
> >