Subject: Re: [pkix] AuthContext Certificate extension - XML

From: Stefan Santesson <[email-masked]>
Date: Wed, 27 Feb 2013 11:41:55 +0100

After discussion with James below I made contextInfo optional and fixed
some minor issues.
Until ID submission starts again, the draft is available here:

http://aaa-sec.com/_temp/draft-santesson-auth-context-extension-04.txt

Diff from published draft 03:
http://tools.ietf.org//rfcdiff?url1=http://tools.ietf.org/id/draft-santesso
n-auth-context-extension-03.txt&url2=http://aaa-sec.com/_temp/draft-santess
on-auth-context-extension-04.txt

/Stefan

On 2/27/13 10:17 AM, "Stefan Santesson" <[email-masked]> wrote:

>James,
>
>After writing this and tanking a car ride to think about it, it strikes
>me 
>as obvious that this should be done exactly as SAML handles LoA
>declarations.
>
>The contextType URI (defining an XML Schema ns) is mandatory.
>The XML defined by the XML Schema is optional.
>
>The mapping rules may be implicit from the contextType URI, in which case
>it may be sufficient just just include the URI.
>
>SAML does this with LoA (AuthnContextClassRef) which is both an
>identifier 
>of an explicit ruleset and an XML Schema ns for expressing details about
>the rules.
>It is very common to just include just the URI and not the XML derived
>from the identified schema as your LoA declaration.
>
>This extension could be used the same way.
>
>/Stefan
>
>
>
>
>On 2/27/13 9:16 AM, "Stefan Santesson" <[email-masked]> wrote:
>
>>Technically you are correct
>>
>>But, there is a clear point of convenience in having the Schema
>>identifier 
>>externally available.
>>
>>Normally you know what schema you expect some XML to follow before you
>>attempt to parse it.
>>That way you can parse it right into e.g. the compiled Java classes that
>>are derived from the schema.
>>
>>If I don't know the schema, I first have to parse the bytes/characters
>>into a neutral XML document and inspect it for name space declarations.
>>
>>The nearest example I can think of is how SAML assertion provides Level
>>of 
>>Assurance (LoA) information.
>>LoA is identified by a URI that also is an XML schema name space
>>identifier for specific LoA information.
>>
>>A SAML assertion may provide just the URI, or the URI and XML according
>>to 
>>the LoA schema.
>>Having the name space URI available outside of the XML makes it so much
>>easier and clean to parse the XML using the correct Schema in one pass.
>>
>>/Stefan
>>
>>
>>
>>On 2/27/13 1:21 AM, "Manger, James H" <[email-masked]>
>>wrote:
>>
>>>Stefan,
>>>
>>>I'm not sure the XML namespace/schema stuff is quite right.
>>>
>>>You use http://id.elegnamnden.se/auth-cont/1.0/saci as: an XML
>>>namespace 
>>>id; imply it is an XML Schema id (or locator); and to identify the type
>>>of authentication context information.
>>>
>>>I doubt you need the contextType field. Shouldn't you just look at the
>>>XML (contextInfo) to see the namespace of the root element (and other
>>>elements), and/or any schemaLocation URIs that are declared? For
>>>example:
>>>
>>><SAMLAuthContext
>>>      xmlns="http://id.elegnamnden.se/auth-cont/1.0/saci"
>>>      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
>>>      
>>>xsi:schemaLocation="http://id.elegnamnden.se/auth-cont/1.0/saci.xsd">
>>>...
>>>
>>>--
>>>James Manger
>>>
>>>
>>>> -----Original Message-----
>>>> From: Stefan Santesson [mailto:[email-masked]]
>>>> Sent: Wednesday, 27 February 2013 10:21 AM
>>>> To: Manger, James H; [email-masked]
>>>> Subject: Re: [pkix] AuthContext Certificate extension
>>>> 
>>>> James,
>>>> 
>>>> After going through the date thing, I concluded that the document
>>>>would
>>>> be better defined and distinct using an XML Schema instead of JSON.
>>>> I therefore decided to agree with you and to simplify the extension.
>>>> 
>>>> I actually think the ability to define what XML Schema that is used is
>>>> enough and I really don't need the option of going JSON or ASN.1 for
>>>> this.
>>>> 
>>>> I have updated the draft but missed the cut-off by 40 minutes.
>>>> 
>>>> The new draft is available here in the mean while:
>>>> http://aaa-sec.com/_temp/draft-santesson-auth-context-extension-04.txt
>>>> 
>>>> /Stefan